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Abstract 

Information  warfare  (IW)  has  developed  into  a  significant  threat  to  the  national 
security  of  the  United  States.  Our  critical  infrastructures  are  linked  together  by 
information  systems  in  a  way  that  is  unprecedented  in  time  and  is  increasingly  vulnerable 
to  information  attack.  However,  beneath  all  the  technical  means  of  instigating  or 
defending  against  such  an  attack  lies  the  individual  decision-maker.  This  study  seeks  to 
understand  sum  of  those  factors  which  affect  the  ability  of  an  individual  to  make  accurate 
decisions  in  an  information  warfare  environment. 

The  study  used  game  theory  to  analyze  the  behavior  of  decision-makers  within  an 
IW  simulation.  The  information  warfare  game  model  is  based  on  a  set  of  games  known 
as  infinitely  repeated  games  of  incomplete  information.  It  uses  the  Bayesian  Nash 
equilibrium  concept  to  determine  the  strategy  which  a  player  should  use  repeatedly  in 
order  to  maximize  his  or  her  payoff. 

The  results  of  the  experiment  show  that  when  a  person  is  faced  with  increasing 
numbers  of  potential  strategies,  he  or  she  is  less  likely  to  make  an  accurate  decision.  The 
results  also  show  that  decision-makers  that  are  faced  with  budgetary  constraints  and 
forced  to  pay  for  alternative  strategies  tend  to  pick  those  strategies  which  are  most 
expensive.  This  is  regardless  of  the  actual  utility  of  the  strategy  as  long  as  it  is  within  the 
decision-makers’  allotted  budget.  Additionally,  the  study  found  that  the  rationality  of  the 
decisions  made  by  an  opponent  did  not  significantly  affect  a  player’s  ability  to  find  the 
strategy  that  maximizes  his  or  her  own  payoff. 


THE  EFFECTS  OF  BUDGETARY  CONSTRAINTS,  MULTIPLE  STRATEGY 
SELECTION,  AND  RATIONALITY  ON  EQUILIBRIUM  ATTAINMENT  IN  AN 
INFORMATION  WARFARE  SIMULATION 


I.  Introduction 


Problem  Statement 

The  United  States  and  the  U.S.  military  are  highly  dependent  on  their  information 
systems.  The  President’s  Commission  on  Critical  Infrastructure  Protection  (1997)  found 
eight  critical  U.S.  infrastructures  which  if  attacked  could  result  in  serious  harm  to  the 
United  States.  These  infrastructures  include  telecommunications,  transportation, 
electrical  power  systems,  water  supply  systems,  gas  and  oil  storage  and  transportation, 
emergency  services,  banking  and  finance,  and  continuity  of  government  services. 

Because  of  the  interlinked  nature  of  these  information  systems,  they  are  increasingly 
vulnerable  to  information  attack  by  malicious  hackers,  terrorist  groups,  rogue  nations,  and 
traditional  adversaries  (Robinson,  98). 

The  vulnerability  of  military  information  systems  has  been  demonstrated  on  at 
least  two  separate  occasions.  The  first  occurred  in  1997  when  the  National  Security 
Agency  (NS  A)  conducted  a  red  team  exercise  called  “Eligible  Receiver”  (Denning,  1999: 
75).  The  NS  A  concluded  that  during  the  exercise,  red  team  hackers  were  able  to 
penetrate  military  information  systems  to  a  point  where  they  could  have  disrupted  and 
delayed  troop  movements.  The  second  demonstration  came  in  1999  at  the  outbreak  of 
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North  Atlantic  Treaty  Organization  (NATO)  operations  against  Serbia.  According  to 
Rapaport  (1999),  Serbian  hackers  launched  a  cyber  attack  against  a  NATO  web  server 
which  managed  to  paralyze  one  of  NATO’s  Sun  Sparc  20  servers.  Though  the  attack  was 
militarily  insignificant,  the  Serbian  attack  as  well  as  other  incidents  do  underscore  the 
need  for  a  method  to  analyze  information  warfare  (IW)  attacks  and  the  decisions  made  by 
those  involved. 

Theory 

Burke  (1999)  proposed  game  theory  as  a  means  to  model  information  warfare  in 
order  to  analyze  the  most  common  strategies  used  in  IW  as  well  as  the  human  behavior 
affecting  those  strategies.  Burke  created  an  information  warfare  game  model  based  on 
the  Nash  and  Bayesian  equilibrium  concepts  to  predict  behavior  and  analyze  the  decisions 
made  in  conducting  information  warfare.  The  goal  of  those  playing  the  game  is  to 
maximize  their  utility.  A  player  achieves  this  by  discovering  and  repeatedly  playing  the 
one  strategy  or  combination  of  strategies  that  maximizes  his  or  her  expected  payoff.  The 
utility  of  the  game  theory  model  is  based  on  the  ability  to  measure  the  player’s  level  of 
equilibrium  attainment.  If  the  game  model  is  unable  to  measure  the  player’s  or  the 
majority  of  the  players’  attainment  of  equilibrium,  then  the  game  model  is  of  little  use  for 
predicting  human  behavior.  This  study  seeks  to  further  Burke’s  research  with  the  goal  of 
refining  the  equilibrium  calculations  in  order  to  better  predict  human  behavior.  It  also 
seeks  to  make  enhancements  to  the  game  model  to  better  reflect  the  environment  in  which 
information  operations  are  conducted. 
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Research  Questions 


The  objective  of  this  study  is  to  develop  enhancements  to  the  IW  Game  Model 
developed  by  Burke  (1999)  and  thereby  improve  its  ability  to  predict  human  behavior. 
This  is  accomplished  by  making  four  changes  to  the  game  model  that  not  only  enhance 
the  model  but  also  suggest  new  issues  for  study.  The  changes  include:  1)  adding 
budgetary  constraints,  2)  allowing  multiple  strategy  selection,  3)  adding  rational  vs. 
irrational  opponent  play,  and  4)  making  changes  to  the  equilibrium  calculations. 

Research  Question  1 :  Do  budgetary  constraints  placed  on  a  player  affect  his  or  her 
ability  to  find  and  use  an  equilibrium  strategy?  Hardly  any  organization  exists  without 
budgetary  constraints.  This  is  true  of  any  organization  conducting  information  attack  or 
defense,  including  the  Department  of  Defense  and  its  adversaries.  Rarely  does  a 
decision-maker  have  all  of  the  resources  wanted  or  required  to  find  and  implement  the 
ideal  strategy  as  quickly  as  desired. 

Research  Question  2:  Does  the  ability  to  implement  more  than  one  strategy  at  a 
time  affect  the  player’s  ability  to  find  and  use  an  equilibrium  strategy?  In  reality,  many 
strategies  are  often  studied  for  implementation.  Often,  one  strategy  alone  is  found  to  be 
lacking  and  consequently  a  combination  of  different  strategies  is  implemented  (Cohen, 
1999).  Furthermore,  the  implementation  is  usually  parallel  rather  then  sequential.  For 
this  reason,  the  game  model  should  allow  players  to  implement  any  combination  of 
strategies  at  once  instead  of  in  sequential  turns.  Further,  an  additional  strategy  available 
to  a  player  may  be  to  choose  to  implement  no  strategy  if  he  is  low  on  funds. 
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Research  Question  3:  Is  a  player  who  faces  a  rational  opponent  more  or  less  likely 
to  discover  and  play  the  equilibrium  strategy  than  a  player  who  faces  an  irrational 
opponent?  It  is  not  guaranteed  that  all  individuals  or  organizations  wishing  to  conduct 
information  warfare  will  act  in  a  rational  manner.  In  fact,  it  could  be  argued  that  terrorist 
organizations  such  as  those  that  commit  suicide  bombings  are  irrational  by  nature.  This 
study  addresses  this  limitation  by  controlling  the  rationality  of  the  subject’s  opponent. 

Research  Question  4:  Does  calculating  equilibrium  as  a  percentage  of  total  game 
play  provide  a  better  measurement  of  equilibrium  attainment  than  calculating  the  number 
of  rounds  to  reach  equilibrium  (NORRE)?  The  original  equilibrium  calculation  by  Burke 
(1999)  estimated  a  player’s  ability  to  find  and  play  the  equilibrium  strategy  by 
determining  at  which  round  of  game  play  the  decision-maker  started  to  play  only  the 
equilibrium  strategy.  This  provided  the  number  of  rounds  to  reach  equilibrium  and  was 
the  primary  measurement  for  the  model.  The  NORRE  calculation  will  still  be  performed; 
however,  it  will  only  serve  as  additional  information  and  comparison.  It  will  not  serve  as 
the  primary  measure  of  equilibrium  attainment. 

Research  Design 

The  research  was  conducted  using  a  within-subjects  and  between-subjects  analysis 
of  variance  (ANOVA)  research  design,  which  used  a  complete  2x2x2  factorial 
experiment.  The  experiment  consisted  of  a  pretest-posttest  control  group  design  (true 
experiment),  as  defined  by  Dooley  (1999).  It  included  8  treatment  groups  comprising  all 
the  possible  combinations  of  factors. 
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Assumptions  and  Limitations 


Although  the  experiment  controls  the  rationality  of  a  player’s  opponent,  this 
model  assumes  that  all  the  subjects  (defenders)  in  the  experiment  are  rational.  That  is, 
they  will  act  in  a  rational  manner  to  maximize  their  expected  payoff.  This  is  also  a 
possible  limitation  of  the  study  because  it  does  not  guarantee  that  all  subjects  will  play  in 
a  rational  manner. 

The  maximization  of  expected  payoffs  is  further  complicated  by  the  fact  that  not 
all  payoffs  are  of  a  monetary  nature  as  depicted  in  the  model.  Therefore,  the  model 
assumes  that  the  monetary  payoff  includes  any  and  all  benefits  a  player  receives  for  his 
actions.  This  includes  but  is  not  limited  to  actual  monetary  gains,  political  gains,  and 
personal  prestige  and  satisfaction. 

Applicability 

Warfare  of  any  kind  is  ultimately  a  social  endeavor.  Though  we  spend  billions  of 
dollars  building  technological  wonders,  the  decisions  of  which  ones  to  build,  as  well  as 
where,  how  and  when  to  use  them,  rest  with  human  beings.  General  George  S.  Patton 
knew  that  part  of  success  in  battle  is  dependent  upon  knowing  your  enemy  and  the 
reasons  why  he  or  she  makes  his  or  her  decisions.  This  is  why  General  Patton  regularly 
studied  the  actions  of  great  military  leaders,  including  those  of  his  enemy  Field  Marshal 
Erwin  Rommel  (Essame:  1974).  Bv  studying  Rommel’s  book  Infantry  Attacks.  General 
Patton  could  predict  and  account  for  the  decisions  that  Rommel  or  any  other  skilled 
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tactician  would  be  likely  to  make  (Allen:  1979).  As  in  traditional  battle,  knowing  how 
and  why  humans  make  the  decisions  they  make  is  crucial  to  the  information  warrior. 

This  study  furthers  prior  research  in  the  field  by  showing  yet  another  way  which 
game  theory  can  be  used  to  study  human  behavior.  It  focuses  on  budgetary  constraints, 
multiple  strategy  selection,  and  opponent  rationality  as  they  pertain  to  three  specific 
strategies.  This,  however,  is  not  the  extent  of  applicability.  The  model  can  easily  be 
adapted  to  a  wide  variety  of  strategies  or  levels  of  conflict.  For  example,  instead  of 
defending  single  organizational  systems,  the  model  could  seek  to  study  overall  strategies 
taken  by  the  United  States  to  defend  our  national  information  infrastructure  against  other 
nation  states  or  terrorist  organizations  by  studying  their  possible  strategies  and  predicted 
behaviors. 

Preview 

Chapter  II  presents  a  general  description  of  both  game  theory,  as  applied  to  the  IW 
game  model,  and  strategies  available  to  information  warfare  and  their  supporting 
literature.  The  section  on  game  theory  includes  a  detailed  description  of  the  formulas 
used  to  calculate  success  probabilities  and  expected  payoffs  in  a  multiple  strategy 
selection  environment.  Chapter  HI  describes  the  methodology  used  to  conduct  and 
analyze  the  experiment.  Chapter  IV  provides  the  analysis  of  the  experiment.  Chapter  V 
discusses  the  results  as  well  as  their  significance  and  provides  recommendations  for 
future  research.  As  a  prelude  to  discussing  the  nature  of  game  theory  and  the  information 
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warfare  game  model  the  next  chapter  starts  with  a  brief  introduction  to  relevant  strategies 
within  the  information  warfare  field. 
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II.  Literature  Review 


Introduction 

This  chapter  is  broken  into  four  main  sections.  The  first  section  provides  a  basic 
overview  of  information  warfare  strategies  and  operations.  The  second  section  provides 
an  overview  of  game  theory  and  how  it  has  been  used  in  the  past  to  predict  human 
behavior.  The  third  section  provides  an  explanation  of  the  information  warfare  game 
model  and  basic  game  theory  concepts  as  applied  to  the  model.  The  final  section 
describes  enhancements  to  the  game  model  and  their  associated  hypotheses  based  on  the 
research  questions  posed  in  Chapter  I. 

Information  Warfare 

As  noted  in  Chapter  I,  the  information  warfare  game  model  can  be  used  to  analyze 
a  multitude  of  differing  IW  threats  and  strategies  at  differing  levels.  Various  authors  such 
as  Denning  (1999),  White  (1998),  Schwartau  (2000),  and  Cohen  (2000)  have  described 
these  threats  in  a  multitude  of  ways.  This  section  describes  those  threats  as  well  as 
proposed  counter  strategies  for  the  information  security  professional  seeking  to  defend  his 
or  her  system. 

Denning  (1999)  describes  IW  threats  in  terms  of  operations,  which  affect  the 
value  of  the  resource  attacked.  After  an  attack  is  made,  a  resource  has  the  possibility  to 
either  gain  or  lose  value  to  the  defender  as  well  as  the  possibility  to  gain  in  value  to  the 
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attacker.  According  to  Denning,  a  number  of  different  operations  cause  this  change  in 
value.  Although  presented  below  with  their  most  likely  outcome,  it  is  important  to  note 
that  the  operations  are  not  mutually  exclusive.  Each  operation  does  have  the  potential  to 
cause  more  than  one  outcome  to  occur  dependent  upon  its  application. 

The  first  outcome  possible  is  an  increase  in  availability  of  the  information 
resource  to  the  offensive  player.  According  to  Denning  (1999:  32-33),  there  are  five 
different  types  of  operations  that  attain  this  outcome  including  “espionage  and 
intelligence  operations”,  “information  piracy”,  “penetration  into  physical  premises  and 
computer  systems”,  “superimposition  fraud”,  and  “identity  theft.”  In  all  cases,  the 
attacker  gains  use  of  the  defenders  resources.  However,  this  does  not  necessarily  mean 
that  the  defender  loses  use  of  his  or  her  resources,  as  is  the  case  in  the  next  scenario. 

Denning’s  (1999:  34)  second  outcome  of  an  information  attack  involves  the 
decrease  in  availability  of  a  resource  to  the  defensive  player.  This  type  of  attack  is 
commonly  known  as  a  denial  of  service  attack  and  takes  the  form  of  three  types  of 
operations,  “physical  theft,  sabotage,  and  censorship.”  This  type  of  attack  may  or  may  not 
result  in  the  attacker  gaining  use  of  the  resource. 

The  third  type  of  possible  outcome  described  by  Denning  results  in  a  decrease  in 
the  integrity  of  the  resource.  This  includes  “tampering,  penetration  and  fabrication” 
operations.  The  goal  of  this  type  of  operation  is  to  manipulate  the  information  in  the 
system  without  the  knowledge  of  the  user.  This  creates  the  possibility  of  the  user  making 
erroneous  decisions  based  on  bad  information. 
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White  (1998:  7-8)  has  a  similar  view  on  threats  to  information  security,  which  can 
be  closely  matched  to  Denning’s  “outcomes”.  White  characterizes  IW  threats  in  terms  of 
objectives  of  the  “cyber-terrorist”.  White’s  objectives  include  the  “destruction,  alteration, 
or  acquisition  and  retransmission  of  data/commands.”  These  objectives  are  attained  by 
using  a  myriad  of  different  electronic  tools  (virus,  worm,  logic  bomb,  bot),  extortion,  or 
social  engineering.  However,  as  shown  by  the  next  author  these  same  tools  can  be  used 
in  information  attacks  at  a  number  of  different  levels. 

Schwartau  (2000:  3)  explains  these  levels  in  a  slightly  different  view  of  the 
classification  of  IW  threats.  He  breaks  information  operations  and  the  threats  that  they 
present  into  three  classes  based  on  their  intensity.  Schwartau  defines  Class  I  as 
operations  aimed  at  individuals,  such  as  identity  theft  or  blackmail.  Class  II  is  defined  as 
industrial  and  economic  espionage,  which  includes  operations  such  as  electronic 
eavesdropping,  hacking,  and  sniffing.  Class  III  is  defined  as  operations  conducted  by 
nation  states  or  against  nation  states.  This  would  include  attacks  against  our  national 
information  infrastructure  by  an  individual  hacker,  a  terrorist  group,  or  a  nation  state. 

In  written  testimony  before  the  Joint  Economic  Committee  of  the  U.S.  Congress, 
Cohen  (2000)  stated  that  the  risks  to  our  information  systems  come  from  a  “combination 
of  threats,  vulnerabilities,  and  consequences.”  Much  like  the  “outcomes”  of  Denning 
(1999)  and  the  “objectives”  of  White  (1998),  Cohen  (2000)  breaks  IW  threats  into 
possible  “consequences”  of  an  information  attack.  These  consequences  include  affecting 
the  confidentiality,  the  availability,  and  the  integrity  of  information  systems. 
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Given  that  these  three  factors  correspond  well  to  those  of  Denning  and  White, 
they  will  serve  as  the  basis  for  the  information  warfare  game  model.  Therefore,  attackers 
and  defenders  playing  the  IW  game  will  be  able  to  perform  operations  to  affect  the 
integrity,  availability,  or  confidentiality  of  the  information  system  and  are  defined  as 
follows: 

1 .  Integrity  Operations:  The  goal  of  this  strategy  is  often  to  effect  the  operations  of 
the  system  without  the  knowledge  of  the  user.  This  strategy  involves  operations 
that  penetrate  the  information  systems,  tamper  with  the  systems,  and  fabricate  and 
/  or  modify  data  within  the  systems. 

2.  Availability  Operations:  This  type  of  operation  is  commonly  known  as  a  denial 
of  service  attack.  It  differs  from  an  integrity  attack  in  that  it  overtly  halts 
operations  instead  of  controlling  the  output  of  operations  (Cohen  2000).  The 
attacker  is  not  concerned  with  forcing  the  user  to  make  erroneous  decisions  based 
on  bad  data  but  to  ensure  that  the  user  get  no  use  out  of  the  system  at  all.  It  takes 
the  form  of  three  types  of  operations:  physical  theft  of  hardware,  sabotage  either 
physically  or  logically,  and  censorship. 

3.  Confidentiality  Operations:  The  goal  of  a  confidentiality  operation  is  to  gather 
sensitive  information.  Five  different  types  of  operations  attain  this  outcome 
including:  espionage  and  intelligence  operations,  information  piracy,  penetration 
into  physical  premises  and  computer  systems,  identity  theft,  and  superimposition 
fraud  (use  of  a  stolen  identity  to  charge  goods  or  services). 


11 


Now  that  the  strategies  or  courses  of  action  are  broken  down  into  their  basic  parts 
and  defined,  they  can  flow  directly  into  the  information  warfare  game  model.  As  shown 
in  the  following  sections,  game  theory  is  a  method  of  mathematically  modeling  complex 
social  interactions.  It  allows  a  player  to  implement  the  strategies  defined  above  in  order 
to  maximize  his  or  her  expected  payoff  and  in  so  doing  reveal  the  reasons  surrounding 
their  decision  process. 

Game  Theory  Overview 

First  developed  by  Von  Neuman  and  Morgenstem  (1944),  game  theory  was 
originally  designed  to  model  economic  activities.  It  involves  two  or  more  players 
determining  courses  of  action  based  on  a  set  of  strategies,  each  with  its  own  payoff 
function.  Each  player  must  base  his  decisions  on  his  beliefs  about  the  other  player’s 
intentions  (Harsanyi,  1995).  The  overall  goal  of  the  game  is  for  each  player  to  choose 
strategies,  which  maximize  his  or  her  expected  utility.  That  is  to  say,  that  each  player 
wants  to  receive  the  most  beneficial  payoff  at  the  end  of  each  round  that  he  or  she  can. 

Since  its  inception,  game  theory  has  evolved  beyond  its  original  purpose  of 
modeling  economic  situations.  Now  game  theory  involves  modeling  complex 
interactions  in  a  number  of  different  disciplines  including  the  political  and  social  sciences 
(Lichbach  1990).  Over  the  years,  game  theory  proved  to  be  an  effective  way  to  analyze 
the  decisions  people  make,  and  to  determine  the  factors  that  influence  those  decisions. 

There  has  been  considerable  work  done  using  game  theory  to  analyze  complex 
negotiations.  Aumann  and  Maschler  (1995)  showed  how  game  theory  was  used  to  model 
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nuclear  disarmament  negotiation  between  the  United  States  and  the  Soviet  Union.  Like 
information  warfare,  the  negotiations  were  games  of  incomplete  information  where  one 
side  never  really  new  the  underlying  objectives  of  the  other.  Zeager  and  Bascom  (1997) 
developed  a  game  model  to  analyze  the  negotiations  between  the  United  Nations  High 
Commission  for  Refugees  and  nation  states  for  the  repatriation  of  refugees  to  the 
countries  of  origin. 

Game  theory  has  also  been  used  to  analyze  situations  of  conflict.  Leathom  (1971) 
used  non-zero  sum  games  to  model  air  combat  situations.  In  another  study,  Healy  and 
Wantchekon  (1999)  created  a  two-sided  incomplete  information  game  to  determine  the 
factors  that  would  lead  a  nation  state  to  use  torture  as  a  method  to  extract  information  or 
to  control  the  society.  Most  recently,  however,  and  as  described  in  the  next  section  Burke 
(1999)  showed  that  a  number  of  factors  within  the  realm  of  game  theory  lend  themselves 
nicely  to  the  modeling  of  information  warfare. 

Information  Warfare  Game  Model 

Now  that  a  basic  idea  of  game  theory  and  its  prior  uses  have  been  provided,  this 
section  describes  how  game  theory  is  implemented  within  the  information  warfare  game 
model.  This  research  will  not  focus  on  an  all-encompassing  overview  of  game  theory  or 
proofs  of  its  theorems.  This  has  already  been  provided  by  a  myriad  of  other  authors  such 
as  Gibbons  (1997),  Aumann  and  Maschler  (1995),  and  is  beyond  the  scope  of  this  study. 
Instead,  this  section  will  focus  only  on  those  aspects  of  game  theory  that  apply 
specifically  to  this  study’s  focus  and  as  they  pertain  to  the  information  warfare  model. 
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Based  on  Nash  and  Bayesian  equilibrium,  the  information  warfare  game  model 
developed  by  Burke  (1999)  is  part  of  a  class  of  games  known  as  infinitely  repeated  games 
of  incomplete  information.  This  type  of  game  lends  itself  nicely  to  the  study  of 
information  warfare  for  a  number  of  reasons,  which  will  become  evident  as  the  model  is 
discussed  throughout  this  chapter.  At  this  point,  however,  the  concepts  of  infinitely 
repeated  games  and  incomplete  information  must  be  related  to  the  study  of  IW. 

“Infinitely  repeated”  refers  to  the  fact  that  neither  player  knows  when  the  game 
will  end.  Round  after  round  is  played  with  each  player  either  winning  or  losing,  and 
gaining  his  or  her  respective  payoff.  In  this  scenario,  the  player  must  make  his  or  her 
decisions  based  on  the  strategy,  which  will  provide  the  best  average  payoff  over  time. 

This  is  similar  to  information  warfare  where  the  defender  cannot  hope  to  successfully 
protect  100  percent  of  his  information  100  percent  of  the  time.  The  defender  must  choose 
a  strategy,  which  best  protects  his  or  her  information  over  time,  dependent  upon  what 
kind  of  information  is  most  important  to  the  defender. 

Repeat  play  allows  a  player  to  change  strategies  on  subsequent  moves  based  on 
the  information  he  or  she  learned  from  the  outcome  of  the  previous  move  (Carlton  and 
Perloff,  1999:  175).  This  is  similar  to  any  form  of  conflict  and  certainly  of  information 
warfare.  As  time  goes  by  and  actions  are  taken,  a  player  will  form  perceptions  about  his 
opponent  and  his  overall  goals.  As  more  information  is  gathered  and  processed,  these 
perceptions  could  be  refined  and  honed  causing  a  change  in  strategy  based  on  the  new 
information. 
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Incomplete  information  refers  to  the  fact  that  each  player  knows  some  or  all  of  the 
information  about  himself  but  not  his  opponent.  In  the  case  of  the  IW  game  model,  a 
player  knows  his  or  her  own  payoff  value  but  not  that  of  his  or  her  opponent.  This  shows 
the  asymmetric  nature  of  information  warfare  in  that  we  often  know  the  defenses  as  well 
as  the  value  of  the  information  we  are  protecting.  However,  we  rarely  know  all  the 
strategies  available  to  our  opponent  or  the  value  of  the  information  to  him,  which  could 
be  different  than  the  value  to  ourselves  (Denning:  1999,  Schwartau  2000). 

Bayesian  Nash  Equilibrium 

The  information  warfare  model  relies  on  what  is  known  as  a  Bayesian  Nash 
equilibrium.  The  calculation  for  this  equilibrium  and  thus  the  strategy  the  player  should 
choose  is  shown  in  a  later  section.  For  now,  it  is  enough  to  know  that  a  Nash  equilibrium 
exists  if;  holding  all  other  strategies  constant,  no  player  can  obtain  a  higher  payoff  (profit) 
by  choosing  a  different  strategy  (Gibbons:  1997).  This  means  that  for  every  set  of 
strategies,  there  is  either  a  single  strategy  or  a  mix  of  strategies  that  the  player  should 
choose  every  time  to  maximize  his  or  her  payoff.  This  is  known  as  the  dominant  strategy 
as  opposed  to  the  other,  weaker  strategies.  The  weaker  strategies  are  said  to  be  dominated 
by  the  dominant  strategy. 

A  Bayesian  Nash  equilibrium  is  a  pair  of  strategies  such  that  each  player’s 
strategy  is  a  best  response  to  the  other  player’s  strategy.  However,  this  is  confounded  by 
the  Bayesian  equilibrium  concept  if  the  player  does  not  know  the  payoff  function  of  his 
opponent.  The  Bayesian  concept  says  that  if  a  player  is  operating  under  incomplete 
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information  and  does  not  know  the  payoff  function  of  his  or  her  opponent,  then  the  player 
must  rely  on  his  or  her  beliefs  about  the  type  of  opponent  he  or  she  is  facing  and  on  his 
associated  payoff  functions  (Gibbons:  1 997).  These  beliefs  may  or  may  not  be  true  and 
have  the  possibility  of  changing  over  time. 

The  actual  equilibrium  strategy  that  a  player  should  employ  is  based  on  a 
mathematical  calculation.  The  calculation  is  based  on  a  number  of  factors,  which  take 
into  account  concepts  such  as  actual  payoff,  success  probability,  and  expected  payoff.  All 
of  these  concepts,  along  with  others,  are  explained  in  the  next  section  on  game  elements. 

Game  Elements 

The  information  warfare  game  model  consists  of  four  main  elements,  which 
include  the  players,  the  payoffs,  information,  and  the  strategies  available  to  the  players. 
Each  of  these  elements  was  touched  on  above.  This  section,  however,  will  seek  to 
explain  each  in  more  detail  as  they  apply  to  the  model 

Every  game  must  have  a  set  of  players  and  the  IW  game  model  is  no  exception. 
The  players  represent  the  decision-makers  of  the  game.  In  theory,  an  infinite  number  of 
players  could  participate  in  a  game  (Shubic,  1982:  26);  however,  most  games  have  a 
specific  set  of  players.  In  the  case  of  the  IW  model,  the  set  of  players  equals  two  and 
consists  of  the  attacker  and  the  defender.  At  each  player’s  disposal  there  are  a  number  of 
resources  to  draw  upon  (funds,  strategies,  manpower,  etc.).  Normally,  the  player  is  also 
assumed  to  be  a  rational  player  and  will  seek  to  maximize  his  or  her  expected  payoff. 
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However,  for  the  purposes  of  this  study’s  research  objectives,  the  attacker’s  rationality 
was  controlled  by  the  experimenter. 

Strategies  are  courses  of  action  or  moves  that  are  available  to  a  player.  The  IW 
game  model  consists  of  three  strategies  available  to  the  attacker.  They  include  attacking 
the  systems  integrity,  the  systems  confidentiality,  and  the  systems  availability.  The 
defender  has  three  strategies  as  well.  They  include  actions  to  defend  the  systems 
integrity,  the  systems  confidentiality,  and  the  systems  availability.  The  strategies 
themselves  are  symmetrical  to  the  attacker  strategies;  however,  the  actions  taken  to 
implement  the  strategies  can  be  quite  different. 

Von  Neumann  and  Morgenstem  (1944:  79)  point  out  that  a  strategy  is  different 
from  making  a  decision  at  every  point  in  the  game.  A  strategy  exists  when  a  player 
makes  a  decision  beforehand  about  his  or  her  actions  given  all  possible  contingencies. 
This  does  not  mean  that  a  player  is  confined  to  a  single  strategy,  just  that  he  has 
predetermined  how  his  actions  will  change  when  given  more  information. 

The  normal  form  of  the  IW  model  is  depicted  by  a  4  x  4  matrix  of  strategies.  This 
includes  the  three  basic  attack  and  defend  strategies  as  well  as  an  option  to  not  implement 
any  strategy.  Since  this  option  is  always  present  in  any  information  warfare  environment, 
it  must  by  available  to  the  players  even  if  it  is  unlikely  to  be  used.  The  matrix,  therefore, 
produces  16  possible  outcomes  depending  on  the  strategy  selected  by  each  player. 

Based  on  Nash  equilibrium,  both  the  attacker  and  the  defender  have  an  optimum 
or  dominant  strategy  (calculation  shown  later)  to  choose  in  order  to  maximize  their 
expected  payoffs.  This  can  be  a  pure  strategy  where  the  player  would  choose  one  strategy 
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every  time  or  it  could  be  a  mixed  strategy  where  the  player  picks  between  two  or  more 
strategies  based  on  a  probability  distribution.  For  example,  the  attacker  could  choose  to 
attack  the  system  integrity  35%  of  the  time  and  attack  the  system  availability  65%  of  the 
time. 

A  player’s  payoff  refers  to  the  state  of  affairs  after  each  player  has  chosen  and 
implemented  a  strategy.  The  value  of  the  payoff  is  indicated  by  the  intersection  of  the 
strategy  matrix  (Shubik,  1982:  70).  The  payoff  for  each  player  in  the  IW  game  model  is 
of  a  monetary  nature  and  it  is  assumed  that  it  represents  all  monetary  or  non-monetary 
gains  or  losses  that  a  player  receives  for  his  or  her  actions.  Table  1  shows  an  example 
payoff  matrix  for  an  IW  game.  The  top  values  at  each  intersection  represent  the 
defender’s  payoff  while  the  bottom  value  represents  the  attacker’s  payoff.  The  attacker 
values  are  shaded  for  clarity.  Each  value  is  the  actual  value  a  player  receives  on  the 
completion  of  one  turn.  For  the  purpose  of  this  study,  the  values  represent  millions  of 
U.S.  Dollars. 


In  keeping  with  the  asymmetrical  nature  of  information  warfare,  the  IW  game 
model  is  a  non-zero  sum  game.  In  other  words,  one  player  does  not  necessarily  win  the 


Table  1.  Actual  Player  Payoff 


Defensive  Strategies 


Integrity 

Availability 

Confidentiality 

None 

Integrity 

-50 

-50 

-50 

-50 

70 

70 

70 

70 

Availability 

-35 

-35 

-35 

-35 

40 

40 

40 

40 

Confidentiality 

-75 

-75 

-75 

-75 

50 

50 

50 

50 

None 

0 

0 

0 

6 

0 

0 

0 

0 
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exact  amount  another  player  looses.  For  example,  an  organization  (Player  A)  may  have 
$50,000  worth  of  customer  information  stored  in  a  database  that  is  compromised  by  a 
hacker  (Player  B).  Player  B  seeks  no  gain  except  the  satisfaction  of  compromising  the 
security.  Player  B’s  subsequent  satisfaction  and  prestige  may  have  a  value  of  $500  while 
Player  A’s  loss  could  be  in  the  hundreds  of  thousands  of  dollars  when  news  of  the  breach 
leaks  and  customers  no  longer  trust  the  organization  and  go  elsewhere. 

Information  is  a  key  component  of  the  IW  game  model.  As  stated  earlier  this  is  a 
game  of  incomplete  information.  Therefore,  the  player  knows  information  about  himself 
but  only  limited  information  about  his  opponent.  This  is  the  same  as  saying  the  player 
knows  his  type  but  not  his  opponent’s.  In  a  game  of  incomplete  information,  a  player 
must  rely  on  his  or  her  beliefs  about  the  type  of  player  that  he  or  she  is  opposing.  This  is 
the  essence  of  Bayesian  theory  (Gibbons:  1997,  Aumann  and  Maschler  1995). 

In  the  IW  game  model,  a  player’s  type  is  defined  by  the  value  of  pursuing  a 
specific  strategy  to  the  player.  For  example,  in  the  payoff  matrix  on  the  previous  page, 
attacking  the  integrity  of  a  system  is  of  most  value  to  the  attacker,  while  defending  the 
confidentiality  of  the  system  is  of  greatest  value  to  the  defender.  Therefore,  the  attacker 
is  of  type  “Integrity”  while  the  defender  is  of  type  “Confidentiality”.  The  importance  of 
knowing  ones  type  in  an  information  warfare  environment  cannot  be  underestimated 
because  knowing  what  is  really  important  is  key  to  being  able  to  defend  it. 

It  is  important  to  note  that  at  the  beginning  of  a  repeated  game  each  player  will 
know  his  or  her  own  type  but  not  the  type  of  his  opponent.  This  is  the  same  as  saying  the 
player  knows  his  own  payoff  function  for  a  specific  strategy  but  not  his  opponent’s 
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(Gibbons,  1997:  136).  However,  as  the  game  progresses  each  player  will  gather  more 
information  about  his  or  her  opponent  and  may  deduce  his  or  her  type.  Additionally,  as 
shown  in  the  next  section,  a  player’s  type  (e.g.  integrity),  although  influential,  does  not 
automatically  equate  to  being  the  player’s  equilibrium  strategy. 

Determining  Expected  Payoff 

Until  now  the  term  payoff  has  been  used  rather  generically.  However,  it  is 
important  to  note  the  difference  between  a  player’s  actual  payoff  and  his  expected  payoff. 
Actual  payoff  refers  to  the  actual  gain  or  loss  experienced  by  the  player  after  the 
completion  of  one  turn  in  a  repeated  game.  One  turn  is  defined  as  each  player  choosing 
and  implementing  a  strategy  simultaneously.  Alternatively,  a  player  s  expected  payoff  in 
the  IW  game  model  takes  into  account  the  probability  of  a  strategy  succeeding  (success 
probability)  as  well  as  the  player’s  beliefs  about  the  other  player’s  type.  The  formulas 
used  for  calculating  expected  payoff  are  as  follows: 

Att.  Expected  Payoff  =  Success  Probability  *  Actual  Payoff 

Def.  Expected  Payoff  =  [(Success  Probability  *  Actual  Loss)  -  Actual  Loss  *  (-1)] 


The  defender’s  success  probability  is  based  on  the  percentage  chance  of  his  chosen 
strategy  defending  against  the  attacker’s  chosen  strategy.  The  attacker’s  success 
probability  is  equal  to  1  minus  the  defense  success  probability  (see  Table  2).  Again,  the 
defender’s  success  probability  is  on  top  while  the  attackers  is  on  the  bottom. 
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Table  2.  Success  Probability  Matrix 


Defender  | 

Attacker 

Integrity 

Availability 

Confidentiality 

None 

Integrity 

0.5 

0.5 

0.2 

0.3 

0.5 

0.5 

0.8 

Availability 

0.5 

0.5 

0.4 

0.5 

0.8 

Confidentiality 

0.5 

0.5 

0.7 

0.2 

0.5 

0.5 

0.3 

0.8 

None 

1 

1 

1 

1 

0 

0 

0 

0 

Table  3  shows  the  expected  payoff  calculations  based  on  the  actual  payoff  and  the 
success  probability  for  Game  II  where  each  player  is  of  type  Integrity.  The  attacker’s 
values  are  grayed  for  clarity.  Note:  the  actual  payoff,  success  probability,  and  expected 


Table  3.  Expected  Payoff  Table 


_ DEfender _ 1 

Attacker 

1  A  C  Ncre 

1 

A 

C 

l\tre 

SUooess  Actual  Expect  Success  Actual  Expect  Success  Actual  Expect  Success  Actiel  Expect 
Rob.  Fctyoff  F&yofF  Rcb.  F^off  F&ydT  Rob.  F&ydT  Patfft  Roh  F^df  F&yofF 

0.70  -70.00  -21.00 
Q30  70.00  21.00 

0.75  -70.00  -17.50 
0.25  70.00  17.50 

0.55  -70.00  -31.50 
0.45  70.00  31.50 

0.20  -70.00  -56.00 
0.80  70.00  56.0C 

0.50  -50.00  -25.00 
Q50  40.00  20.00 

0.40  -50.00  -30.00 
0.60  40.00  24.00 

0.60  -50.00  -20.00 
0.40  40.00  16.00 

020  -50.00  -40.00 
Q80  40.00  3200 

0.50  -25.00  -1250 
0.50  55.00  27.50 

0.50  -25.00  -1250 
0.50  55.00  27.50 

0.20  -25.00  -20.00 
0.80  55.00  44.0C 

1.00  0.00  0.00 

0.00  0.00  0.00 

1.00  0.00  0.00 

0.00  0.00  0.00 

1.00  0.00  0.00 

0.00  0.00  0.00 

1.00  0.00  0.00 

0.00  0.00  0.00 

payoff  values  used  in  this  experiment  for  the  basic  game  are  the  same  as  those  developed 
and  used  by  Burke  for  the  sake  of  consistency  and  comparability.  Later  it  is  shown  that 
the  basic  values  can  be  extended  to  strategies  for  games  in  which  players  are  allowed  to 


select  multiple  strategies  in  a  single  turn.  Now  that  the  expected  payoffs  are  known  for 
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each  alternative  outcome,  it  is  possible  to  explain  how  expected  payoffs  are  used  to 
determine  a  player’s  equilibrium  strategy. 

Determining  Equilibrium  Strategy 

A  player’s  equilibrium  strategy  in  any  game  of  incomplete  information  is  the 
strategy  or  set  of  strategies  that  is  a  best  response  to  the  opponent’s  strategy  (Gibbons, 
1997:  137).  This,  however,  takes  into  account  the  player’s  beliefs  about  the  other 
player’s  type.  Determining  each  player’s  equilibrium  is  a  two  step  process,  which  sets  a 
probability  distribution  over  the  set  of  strategies.  It  is  important  to  remember  that 
determining  the  equilibrium  strategy  is  based  on  the  expected  payoff  instead  of  the  actual 
payoff  in  order  to  account  for  the  probability  of  the  attack  succeeding.. 

The  first  step  to  determine  the  equilibrium  strategy  is  to  eliminate  dominated 
strategies  from  consideration.  A  dominated  strategy  is  a  strategy  that  is  never  a  best 
response  to  any  strategy  played  by  the  opponent.  Because  a  dominated  strategy  has  no 
chance  of  being  played,  it  is  given  a  value  of  zero  in  the  probability  distribution.  This  is 
not  to  say  that  a  player  can  not  choose  the  strategy  but  that  he  or  she  should  not  in  order 
to  maximize  his  or  her  utility. 

Referring  back  to  table  3  for  Game  II,  the  attacker’s  Availability  strategy  and  the 
defender’s  Integrity  strategy  both  have  probability  of  zero  because  in  each  case  it  would 
be  wiser  to  choose  another  strategy.  For  instance,  if  the  attacker  chose  an  Availability  or 
Confidentiality  strategy  the  defender  loses  less  money  based  on  expected  payoff  by  using 
a  Confidentiality  strategy.  If  the  attacker  chooses  an  Integrity  strategy  the  defender’s  best 
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option  is  to  choose  an  Availability  strategy  in  order  to  lose  the  least  amount  if  money. 
Likewise,  it  is  never  good  for  either  player  to  choose  no  strategy  so  it  is  also  given  a  value 
of  zero. 

The  second  step  to  determining  the  equilibrium  strategy  is  to  apply  a  probability 
distribution  across  the  remaining  strategies.  This  is  done  by  solving  the  four  equations 
below  provided  by  Burke  (1999:  32).  In  essence,  what  the  equations  does  is  set  the  sum 
probability  of  each  player’s  remaining  strategies  equal  to  one.  Then  it  determines  how 
often  each  should  be  play  based  on  the  expected  payoff  of  each  strategy  to  both  the 
attacker  and  the  defender. 


P(Att.  I)  +  P(Att.  C)  =  1 
P(Def.  A)  +  P(Def.  C)  =  1 

-17.5  *  P(Att.  I)  -  12.5  *  P(Att.  C)  =  -31.5  *P(Att.  I)  -  9.25  *  P(Att.  C) 

17.5  *  P(Def.  A)  +  31.5  *  P(Def.  C)  =  -27.5  *P(Def.  A)  +  15.125  *  P(Def.  C) 
Results: 

Attacker:  P(I)  =  0.18,  P(C)  =  0.82 
Defender:  P(A)  =  0.63,  P(C)  =  0.37 


The  preceding  equations  provide  a  mixed  strategy  profile  where  the  attacker 
should  choose  an  Integrity  attack  1 8%  of  the  time  and  a  Confidentiality  attack  82%  of  the 
time.  The  Defender,  however,  should  choose  an  Availability  defense  63%  of  the  time 
while  choosing  a  Confidentiality  defense  37%  of  the  time  in  order  to  maximize  the 
expected  payoff.  Notice  that  even  though  both  the  defender  and  the  attacker  are  of  type 
Integrity,  it  is  never  beneficial  for  the  defender  to  use  integrity  as  a  defense.  The  repeated 
nature  of  the  game  should  allow  a  player  to  come  to  this  realization  over  time. 
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Model  Enhancements  and  Hypotheses 


The  preceding  section  described  the  basic  elements  of  the  IW  game  model, 
including  the  underlying  game  theoretic  concepts.  The  following  four  sections  describe 
enhancements  made  to  the  information  warfare  model.  These  enhancements  fall  directly 
out  of  the  research  questions  discussed  in  Chapter  I.  They  include:  allowing  a  person  to 
implement  more  the  one  strategy  at  a  time,  instituting  budgetary  constraints,  controlling 
the  rationality  of  the  opposing  player,  and  modifying  the  calculation  to  measure 
equilibrium  attainment  by  the  players.  This  section  also  states  the  hypotheses  associated 
with  the  enhancements. 

Multiple  Strategy  Selection 

Decision-makers  are  rarely  limited  to  implementing  a  single  strategy.  Often 
times,  lack  of  complete  information  about  threats  can  force  a  decision-maker  to 
implement  multiple  strategies  to  ensure  that  all  of  his  or  her  bases  are  covered.  Even  if 
complete  information  is  known,  a  combination  of  strategies  may  be  called  for.  Cohen 
(1999)  views  this  approach  as  “combining  the  effectiveness  of  the  different  approaches 
to  different  degrees”  so  that  a  mix  of  strategies  coexists  over  time.  This  can  also  be 
thought  of  as  a  layering  of  defensive  strategies.  In  military  terms,  this  is  known  as  defense 
in  depth  or  full  dimensional  protection  (Turk  and  Hollingsworth:  1999;  DOD:  2000). 

At  first  glance,  it  may  seem  beneficial  to  always  implement  multiple  strategies. 
This  however,  may  not  be  the  case  for  all  situations.  The  benefits  of  selecting  multiple 
strategies  must  always  be  weighed  against  loses  that  can  occur  by  spreading  resources  to 
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thinly.  In  trying  to  protect  everything  a  player  may  leave  his  or  her  most  valuable 
resources  vulnerable  degree  that  is  unacceptable. 

For  the  purposes  of  the  IW  game  model,  a  combination  of  strategies  can  be 
thought  of  as  a  strategy  in  and  of  itself.  In  other  words,  each  possible  combination  of  the 
available  strategies  becomes  its  own  strategy  providing  eight  alternatives  for  the  player  to 
choose  from.  Previous  studies  have  shown,  that  the  number  of  alternatives  available  was 
significantly  inversely  related  to  the  accuracy  of  decisions  made  (Malhotra:  1982,  Best 
and  Ursic:1987,  Helgeson  and  Ursic:  1993).  It  is  conceivable,  therefore,  that  allowing  a 
player  to  choose  multiple  strategies  at  one  time  will  decrease  that  player’s  ability  to 
identify  and  play  the  equilibrium  strategy. 

Hypothesis  1 :  Multiple  strategy  selection  will  decrease  a  player’s  ability  to 
identify  and  play  the  equilibrium  strategy  and  thus  result  in  a  lower 
equilibrium  score. 

The  eight  alternatives  created  by  allowing  multiple  selection  turn  the  original  4  x 
4  matrix  of  strategy  payoffs  into  a  8  x  8  matrix  with  64  possible  outcomes  or  strategy 
combinations  as  shown  in  Table  4.  The  payoffs  for  each  combination  of  strategies  are 
merely  an  average  of  the  strategies  utilized  by  the  attacker.  It  must  be  remembered  that 
the  loss  a  defender  realizes  is  dependent  on  the  value  of  the  information  attacked  by  the 
attacker.  If  an  attacker  succeeds  in  a  combination  of  Integrity  and  Availability  attack,  the 
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defender  loses  the  same  amount  whether  he  or  she  defends  against  that  type  of  attack  or 


chooses  no  strategy  whatsoever. 


Table  4.  Actual  Player  Payoff  for  Multi-Strategy  Game 


Defender  | 

Attacker 

1 

IA 

1C 

A 

AC 

C 

IAC 

None 

1 

-70.00 

-70.00 

-70.00 

-70.00 

-70.00 

-70.00 

-70.00 

-70.00 

70.00 

70.00 

70.00 

70.00 

70.00 

70.00 

70.00 

70.00 

IA 

-60.00 

-60.00 

-60.00 

-60.00 

-60.00 

-60.00 

-60.00 

-60.00 

55.00 

55.00 

55.00 

55.00 

55.00 

55.00 

55.00 

55.00 

1C 

-47.50 

-47.50 

-47.50 

-47.50 

-47.50 

-47.50 

62.50 

62.50 

62.50 

62.50 

62.50 

62.50 

62.50 

62.50 

A 

-50.00 

-50.00 

-50.00 

-50.00 

-50.00 

-50.00 

-50.00 

-50.00 

40.00 

40.00 

40.00 

40.00 

40.00 

40.00 

40.00 

40.00 

AC 

-37.50 

-37.50 

-37.50 

-37.50 

-37.50 

-37.50 

-37.50 

-37.50 

47.50 

47.50 

47.50 

47.50 

47.50 

47.50 

47.50 

47.50 

C 

-25.00 

-25.00 

-25.00 

-25.00 

-25.00 

-25.00 

-25.00 

-25.00 

55.00 

55.00 

55.00 

55.00 

55.00 

55.00 

55.00 

55.00 

IAC 

-48.33 

-48.33 

-48.33 

-48.33 

-48.33 

-48.33 

-48.33 

-48.33 

55.00 

55.00 

55.00 

55.00 

55.00 

55.00 

55.00 

55.00 

None 

0.00 

0.00 

0.00 

0.00 

0.00 

mm 

0.00 

0.00 

0.00 

0.00 

0.00 

0.00 

0.00 

Hi 

0.00 

0.00 

Allowing  a  player  to  implement  multiple  strategies  must  also  take  into  account  the 
probability  of  success  for  using  more  than  one  strategy.  The  success  probability  of  using 
two  strategies  is  not  necessarily  the  sum  of  the  success  probabilities  of  the  individual 
strategies.  As  pointed  out  by  Denning  (1999:  37),  strategies  in  information  warfare  are 
not  “mutually  exclusive”  and  many  of  the  tools  used  fall  into  more  than  one  category. 
This,  however,  does  not  mean  that  benefits  to  using  more  than  one  defensive  strategy  are 
non-existent.  Indeed,  many  of  the  tools  used  could  have  a  synergetic  effect. 
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Table  5.  Success  Probability  Matrix  for  Multi-Strategy  Game 


Defender 

Attacker 

i 

IA 

1C 

A 

AC 

C 

IAC 

None 

1 

■ 

0.83 

mm 

0.75 

0.75 

0.55 

0.87 

EH 

| 

0.18 

0.25 

0.25 

0.45 

0.13 

IA 

0.50 

0.61 

0.59 

0.48 

0.58 

0.48 

0.58 

0.50 

0.39 

0.41 

0.53 

0.43 

0.53 

0.42 

E1E 

1C 

0.50 

HSHH 

0.60 

0.53 

0.61 

0.49 

ESI 

0.50 

0.41 

0.48 

0.39 

0.51 

EH 

A 

0.50 

MEM 

0.40 

0.60 

0.60 

0.50 

EH 

0.35 

0.60 

0.40 

0.40 

AC 

0.48 

0.56 

0.35 

0.53 

0.52 

0.52 

0.53 

0.44 

0.65 

0.47 

0.49 

0.48 

f*' a 

C 

0.50 

Eg| 

0.67 

0.50 

0.67 

0.63 

0.74 

■ 

0.50 

EH 

0.34 

0.50 

0.34 

0.37 

0.26 

IAC 

0.46 

0.48 

0.35 

0.47 

0.39 

0.57 

0.10 

0.54 

0.52 

0.65 

0.53 

0.61 

0.43 

0.90 

None 

1.00 

1.00 

1.00 

1.00 

1.00 

1.00 

1.00 

■  - 

0.00 

0.00 

0.00 

0.00 

0.00 

0.00 

0.00 

■H 

To  account  for  synergistic  effects  of  multiple  strategies,  when  calculating  the 
defender’s  success  probability,  the  IW  game  model  takes  the  average  of  the  success 
probabilities  for  the  chosen  strategies  and  adds  10  percent  for  each  additional  strategy 
chosen  above  the  number  chosen  by  the  attacker.  Since  the  attacker’s  success  probability 
is  dependent  on  the  defender,  there  is  no  change  in  the  attacker’s  success  probability 
formula.  The  success  probability  for  the  attacker  remains  one  minus  the  success 
probability  of  the  defender.  The  success  probabilities  for  the  multiple  strategy  selection 
version  of  Game  II  are  shown  in  Table  5.  It  is  important  to  note  that  combining  strategies 
does  not  always  insure  a  higher  probability  of  success  against  any  given  attack. 


Budgetary  Constraints 

Often  times  a  decision-maker  must  take  into  account  the  monetary  cost  of 
differing  strategies.  Denning  (1999:  37)  points  out  that  it  is  not  always  “cost  effective  - 
or  even  possible  -  to  provide  sufficient  defenses  to  prevent  all  offensive  operations  and 
avoid  all  losses”.  A  decision-maker,  therefore,  must  decide  where  it  is  best  to  invest  his 
or  her  limited  resources. 

Budget  constraints  have  the  potential  to  affect  a  decision-maker’s  choice,  whether 
or  not  he  or  she  has  sufficient  funds  to  cover  all  possibilities.  For  example,  “you  get  what 
you  pay  for”  is  a  term  that  is  often  associated  with  the  linking  of  quality  with  price.  It  is 
feasible  that  a  decision-maker  could  believe  that  a  higher  priced  strategy  will  equate  to  a 
better  defense  or  that  a  lower  priced  strategy  will  save  the  company  money.  Though  this 
is  possible,  it  is  not  necessarily  the  case.  Either  case  could  lead  to  a  loss  of  value  in  the 
form  of  the  value  of  stolen  information  or  monetary  costs. 

Monetary  constraints  were  operationalized  in  the  IW  model  by  providing  the 
player  with  a  monthly  budget  to  be  used  on  the  purchase  of  IW  strategies.  Each  strategy 
had  a  monetary  cost  associated  with  it,  which  was  subtracted  from  the  player’s  budget 
each  time  it  was  selected.  For  games  in  which  multiple  strategies  could  be  selected  on 
each  turn,  the  cost  was  equal  to  the  sum  of  the  individual  strategies.  Though  the  player 
was  working  on  a  limited  budget,  care  was  taken  to  ensure  that  he  or  she  had  a  sufficient 
amount  to  play  the  equilibrium  strategy  (i.e.,  Availability  63%,  Confidentiality  37%). 
However,  it  is  hypothesized  that  working  on  a  budget  will  reduce  a  player’s  equilibrium 
attainment. 
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Hypothesis  2:  Budgetary  constraints  will  decrease  a  player’s  ability  to 
identify  and  play  the  equilibrium  strategy  and  thus  result  in  a  lower 
equilibrium  score. 

Opponent  Rationality 

Game  theory  generally  assumes  that  all  players  will  act  rationally  (Gibbons, 
Harsanyi,  et  al).  That  is  to  say  that  a  player  will  always  make  decisions  on  the  basis  of 
maximizing  his  or  her  utility.  Myerson  (1992:  66)  points  out,  however,  that  according  to 
experimental  evidence  “axioms  of  consistency  in  decision  making”,  which  are  the  basis 
of  rational  utility  maximization,  are  often  violated  in  real  life.  In  other  words,  this  is  not  a 
perfect  world  and  people  do  not  always  make  decisions  that  maximize  their  utility. 

The  possibility  of  a  player  making  decisions  that  are  not  of  a  rational  nature  poses 
an  interesting  question.  How  does  facing  an  irrational  or  seemingly  irrational  opponent  in 
the  IW  game  model  affect  a  player’s  ability  to  identify  and  play  the  equilibrium  strategy? 
This  situation  can  come  up  in  one  of  two  ways.  Either  the  player’s  opponent  is  not  of, 
what  most  people  would  call,  a  rational  mind  or  the  opponent’s  utility  (or  perceived 
utility)  is  so  different  from  the  player’s  that  what  is  rational  for  the  opponent  is  seemingly 
irrational  to  the  player. 

Hypothesis  3:  Facing  a  seemingly  irrational  opponent  will  decrease  a  player’s 
ability  to  identify  and  play  the  equilibrium  strategy  and  thus  result  in  a 
lower  equilibrium  score. 
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Information  warfare  is  not  devoid  of  these  types  of  situations.  Unlike  traditional 
warfare,  IW  has  the  ability  to  totally  mask  the  identity  of  the  attacker  and  thus  hamper  the 
defender’s  ability  to  determine  his  or  her  overall  objectives.  Cronin  contends  that  this 
“near  unknowability  of  the  attackers  coupled  with  the  nagging  uncertainty  as  to  his 
driving  motivations”  is  one  of  the  most  critical  aspects  of  information  warfare  (1999: 
259).  This  view  is  seemingly  supported  by  the  former  Commander  of  U.S.  Space 
Command  and  current  Vice  Chairman  of  the  Joint  Chiefs  of  Staff,  General  Richard 
Myers.  According  to  General  Myers,  one  of  the  biggest  problems  facing  the  military 
when  confronted  with  a  cyber  attack  is  determining  the  nature  of  the  attacker.  “Is  it  a 
nation-state?  Is  it  a  terrorist?  Is  it  a  hacker  or  someone  out  for  a  joyride  on  the  Internet?” 
(Boyle,  2000)  A  rational  decision  for  any  one  of  these  players  may  well  be  irrational  for 
another  as  well  as  for  the  defender. 

This  study  sought  to  account  for  the  possibility  of  facing  a  seemingly  irrational 
opponent  by  controlling  his  or  her  rationality.  Unlike  the  original  IW  game  model  study, 
the  subjects  in  this  study  played  the  computer,  which  acted  as  the  opponent,  instead  of 
another  subject.  Half  of  the  treatment  groups  played  a  rational  opponent  who  played  only 
equilibrium  strategies  based  on  their  equilibrium  percentage  (i.e.,  Integrity  attack  18%  of 
the  time  and  a  Confidentiality  attack  82%)  while  the  other  half  played  a  seemingly 
irrational  opponent  who  chose  between  all  alternative  strategies  randomly. 
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Equilibrium  Calculations 


As  pointed  out  by  Burke  (1999:  67),  his  original  study  was  limited  by  the  method 
used  to  calculate  equilibrium  play.  This  is  because  using  the  number  of  rounds  to  reach 
equilibrium  (NORRE)  calculation  to  measure  equilibrium  attainment  among  players  has 
two  inherent  weaknesses.  Those  weaknesses  along  with  a  proposed  solution  is  the  focus 
of  this  section. 

First,  NORRE  does  not  account  for  players  who  attain  equilibrium  play  early  on  in 
the  game  but  happen  to  play  a  non-equilibrium  strategy  late  in  the  game  in  an  attempt  to 
throw  off  their  opponent.  For  example,  a  player  could  realize  the  equilibrium  strategy  at 
Round  5  and  play  it  until  Round  35.  At  that  point,  he  could  decide  to  play  a  non¬ 
equilibrium  strategy  for  a  round  or  two  in  order  to  try  to  confuse  his  opponent.  The 
formula  would  then  determine  that  the  player  attained  equilibrium  at  Round  35  instead  of 
Round  5. 

The  second  problem  with  the  NORRE  calculation  is  that  the  calculation  does  not 
account  for  differing  levels  of  equilibrium  strategies.  For  example,  the  equilibrium 
strategy  may  be  to  play  strategy  “A”  83  percent  of  the  time  and  strategy  “B”  1 7  percent  of 
the  time.  The  previous  calculation  only  examines  at  which  point  the  player  stops  playing 
anything  but  the  equilibrium  strategy.  It  does  not  take  into  consideration  if  the  player 
played  strategy  “A”  40  percent  of  the  time  and  strategy  “B”  60  percent  of  the  time. 

This  study  proposes  to  calculate  the  equilibrium  attainment  measure  by  using  a 
percentage  instead  of  the  raw  number  of  rounds  needed  to  reach  equilibrium.  In  other 
words,  equilibrium  attainment  will  be  measured  as  a  percentage  of  total  rounds  played. 
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This  can  be  calculated  at  any  round  of  play  or  as  a  total  for  the  entire  game.  The 
independent  variables,  therefore,  can  be  measured  by  how  close  a  player  came  to  the  ideal 
equilibrium  percentages  (e.g.  strategy  “A”  83%,  Strategy  “B”  17%).  This  change  in 
calculation  should  create  a  more  robust  IW  game  model. 

Hypothesis  4:  Measuring  equilibrium  as  a  percentage  of  total  rounds  played 
(Percent  Equilibrium  Attainment)  will  result  in  a  higher  mean  equilibrium 
score  than  calculating  the  number  of  rounds  to  reach  equilibrium  (NORRE). 

Summary 

This  chapter  sought  to  provide  insight  into  the  information  warfare  game  model 
and  the  enhancements,  which  are  the  focus  of  this  study.  It  provided  a  general  overview 
of  current  strategies  in  IW  as  well  as  those  used  in  the  study.  The  chapter  also  provided 
an  overview  of  game  theory  as  it  applies  to  the  study.  Finally,  this  chapter  provided  an 
explanation  of  the  model  enhancements  as  well  as  the  stated  hypotheses.  The  next 
chapter  will  explain  the  methodology  used  to  test  the  stated  hypotheses. 
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III.  Methodology 


Introduction 

The  preceding  chapter  explained  the  basic  strategies  within  information  warfare, 
described  the  information  warfare  game  model,  and  provided  model  enhancements  based 
on  the  stated  research  questions  in  Chapter  I.  This  chapter  will  seek  to  explain  the 
methodology  used  to  test  the  hypotheses  that  were  developed  in  Chapter  II.  It  will  do  this 
by  first  describing  the  basic  research  design  for  the  experiment.  It  will  then  show  how 
and  why  subjects  were  selected  for  the  experiment  and  placed  in  their  treatment  groups. 
Then  the  basic  conduct  of  the  experiment  will  be  shown  followed  by  a  description  of  the 
experimental  game  software  used.  Finally,  this  chapter  will  end  by  presenting  the 
statistical  analysis  that  will  be  used  to  test  the  hypotheses  in  Chapter  IV. 

Research  Design 

As  stated  in  Chapter  I,  this  research  was  conducted  using  a  within-subjects  and 
between-subjects  analysis  of  variance  research  design.  The  experiment  consisted  of  a 
pretest-posttest  control  group  design  (true  experiment)  as  defined  by  Dooley  (1999)  and 
included  8  treatment  groups  to  form  a  complete  2x2x2  factorial  experiment.  The 
research  design  is  depicted  in  figure  1  on  the  following  page. 
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Figure  1.  Research  Design 


The  experiment  involved  two  rounds  of  game  play  for  each  group.  In  the  first 
round  (pretest),  all  groups  played  without  a  budget,  were  limited  to  just  one  strategy  per 
turn,  and  faced  a  rational  opponent.  This  constitutes  the  baseline  and  is  identical  to 
treatment  one  in  the  posttest.  The  second  round  of  play  (posttest)  consisted  of  each 
subject  playing  the  game  based  on  one  of  the  eight  treatments.  The  eight  treatments  are 
as  follows  with  the  control  group  being  treatment  number  one. 


Treatment  1 :  No  Budget 
Treatment  2:  No  Budget 
Treatment  3:  No  Budget 
Treatment  4:  No  Budget 
Treatment  5:  Budget 
Treatment  6:  Budget 


Single  Strategies 
Single  Strategies 
Multiple  Strategies 
Multiple  Strategies 
Single  Strategies 
Single  Strategies 


Rational  Opponent 
Irrational  Opponent 
Rational  Opponent 
Irrational  Opponent 
Rational  Opponent 
Irrational  Opponent 


34 


Treatment  7:  Budget  Multiple  Strategies  Rational  Opponent 

Treatment  8:  Budget  Multiple  Strategies  Irrational  Opponent 

Figure  2  provides  a  graphical  depiction  of  the  full  model.  The  dependent  variable 
in  this  experiment  is  the  percentage  of  equilibrium  attainment  for  a  single  player  during  a 
single  game.  The  independent  variables  are  whether  a  player  has  budgetary  constraints, 
whether  the  player  is  allowed  to  play  more  than  one  strategy  simultaneously,  and  whether 
the  player  is  facing  a  rational  opponent  or  an  irrational  opponent. 


Figure  2.  Effects  of  Independent  Variables  on  Equilibrium  Attainment 
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Subject  Selection  and  Assignment 


The  population  of  interest  for  this  experiment  consisted  of  those  individuals  who 
currently  are  or  that  are  likely  in  the  future  to  make  decisions  regarding  defensive 
information  warfare  policies.  The  sampling  frame  consisted  of  graduate  students 
attending  the  Air  Force  Institute  of  Technology  (AFIT).  Results  from  the  sampling  frame 
can  be  generalized  to  the  larger  population  due  to  two  reasons.  First,  all  the  graduate 
students  are  professional  military  officers  who  have  been  in  the  field  where  they  likely 
had  to  make  similar  decisions  of  utility  maximization  in  the  past.  Second,  graduate 
students  at  AFIT  will  return  to  operational  and  staff  units  where  they  will  be  expected  to 
make  or  recommend  such  decisions. 

The  experiment  was  conducted  During  November  and  December  of  2000.  The 
sample  size  consisted  of  80  volunteers  from  the  sampling  frame,  playing  two  games  each. 
The  sampling  size,  which  allowed  for  10  people  per  treatment  group,  was  based  on 
recommendations  for  the  design  of  controlled  experiments  by  McClave,  Benson,  and 
Sincich  (1998).  The  sampling  size  also  allowed  the  experiment  to  achieve  its  desired 
power  level  of  greater  than  0.80. 

Subjects  were  randomly  assigned  a  subject  number  using  the  random  numbers 
generator  in  Microsoft  Excel.  The  subject  number  generated  subsequently  determined  the 
treatment  group  in  which  the  subject  was  placed.  During  each  round  of  play,  which  is 
described  in  the  next  section,  the  subjects  were  assigned  a  role  as  a  defender.  The 
attacker  in  each  round  was  played  by  the  computer,  allowing  the  experimenter  to  control 
the  attacker’s  rationality. 
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The  Experiment 


The  experiment  consisted  of  two  separate  games  being  played.  The  first  game 
(pretest)  took  place  in  early  November  2000  and  consisted  of  each  subject  playing  the  IW 
game  with  the  same  treatment  (Treatment  1,  control  group  treatment).  The  experiment 
was  administered  by  e-mailing  a  link  to  the  Information  Warfare  Game,  which  resided  on 
a  network  drive  at  AFIT,  to  each  of  the  subjects.  The  subjects  were  given  simple 
instructions  in  the  e-mail  to  click  on  the  link  and  play  the  game. 

To  ensure  uniformity  among  all  players,  the  computer  provided  all  game  play 
instructions.  To  ensure  that  the  subjects  actually  read  and  understood  the  instructions, 
each  subject  was  given  a  short  quiz  before  the  start  of  play.  A  copy  of  the  instructions 
provided  to  the  players,  the  quiz  and  screen  shots  from  the  game  can  by  found  in 
appendixes  A  -  E.  Once  a  player  reached  the  end  of  game  play,  the  program  thanked  the 
subject  for  his  or  her  efforts  and  automatically  terminated. 

The  second  game  (post  test)  occurred  approximately  three  weeks  after  the  first 
round.  This  combined  with  the  simplicity  of  the  game  should  have  been  sufficient  time  to 
account  for  learning  effects.  The  second  round  of  game  play  was  administered  identical 
to  the  first.  However,  in  this  round  each  group  played  with  the  factors  associated  with 
their  treatment  groups.  The  control  group  (Treatment  Group  1)  played  with  the  same 
factors  as  round  one. 

Both  rounds  consisted  of  playing  a  mixed  strategy  game.  However,  a  different 
game  was  played  in  each  round  in  an  additional  control  for  learning  effects.  Round  one 
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consisted  of  game  II  where  both  the  attacker  and  the  defender  were  of  type  Integrity.  This 
equated  to  the  equilibrium  strategy  for  the  attacker  consisting  of  1 8%  Integrity  and  82% 
Confidentiality.  The  defender’s  equilibrium  strategy  consisted  of  playing  Availability 
63%  of  the  time  and  Confidentiality  37%  of  the  time. 

In  round  two,  the  subjects  played  game  Cl  where  the  attacker  was  of  type  Integrity 
and  the  defender  was  of  type  Confidentiality.  The  equilibrium  strategies  for  the  attacker 
and  defender  varied  depending  on  whether  they  could  select  multiple  strategies  or  not. 

For  single  strategy  selection  games,  the  attacker’s  equilibrium  strategy  consisted  of 
playing  Integrity  58%  of  the  time  and  Availability  42%  of  the  time.  The  defender’s 
equilibrium  strategy  included  playing  Integrity  86%  of  the  time  and  Availability  14%  of 
the  time.  In  the  multiple  strategy  games,  the  attacker’s  equilibrium  strategy  consisted  of 
playing  Integrity  19%  of  the  time  while  playing  a  combination  of  Integrity,  Availability, 
and  Confidentiality  81%  of  the  time.  The  defender  should  have  played  Integrity  52%  of 
the  time  while  playing  a  combination  of  Integrity,  Availability,  and  Confidentiality  47% 
of  the  time. 

The  Game 

The  information  warfare  game  software  used  for  this  experiment  was  the  same 
created  and  used  by  Burke  (1999)  but  re-coded  with  the  enhancements  discussed  in 
Chapters  I  and  II.  The  game  is  based  on  Microsoft  ACCESS  and  Visual  Basic  code. 

Each  player,  both  the  attacker  (computer  automated)  and  the  defender  (the  subject),  had 
three  information  warfare  strategies  to  choose  from  with  the  option  of  playing  zero  to  all 
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of  them  on  each  repetition.  This,  however,  was  limited  by  the  amount  of  funds  available 
or  by  the  treatment  assigned.  A  player  knew  if  his  or  her  strategy  was  successful  by  the 
payoff  or  loss  that  he  or  she  received  in  monetary  form  at  the  end  of  each  repetition  (each 
player  selecting  a  strategy). 

The  defenders  were  not  told  that  they  were  playing  a  computer  opponent. 
However,  because  of  the  nature  of  the  game  it  is  assumed  that  the  subjects  came  to  this 
realization.  In  any  case,  it  should  not  have  made  a  difference  in  game  play.  This  is 
because  a  player’s  equilibrium  strategy  is  always  the  best  response  to  any  strategy  chosen 
by  the  computer.  The  player  therefore  should  have  still  been  able  to  determine  the  best 
strategy  to  play. 

The  goal  of  the  player  was  to  find  the  strategy  or  mix  of  strategies,  which 
maximizes  his  or  her  payoff  over  the  long  run.  This  is  consistent  with  the  instructions 
that  the  player  received  by  a  pre  written  script  on  the  computer.  The  only  instructions 
given  by  the  experimenter  were  to  click  on  the  game  link  and  play  the  game.  Each  game 
consisted  of  fifty  repetitions  of  each  player  (attacker  and  defender)  choosing  a  strategy  or 
strategies  to  play  and  then  viewing  his  payoff  or  loss. 

The  game  software  recorded  each  move  made  by  both  the  attacker  and  defender 
for  every  game.  In  addition,  it  recorded  the  amount  of  dollars  spent  on  differing  strategies 
at  each  round.  It  can  be  expected  that  at  first  a  player’s  strategy  or  strategies  will  vary 
considerably.  However,  as  each  payoff  or  loss  is  observed,  the  player  should  be  able  to 
calculate  the  equilibrium  strategy  or  combination  of  strategies,  which  provides  the 
maximum  gain  over  time.  This  of  course  works  off  the  assumption  that  the  subject  will 
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actually  seek  to  maximize  his  or  her  payoff  as  they  were  told  to  do  in  the  instructions. 
Since  all  of  the  subjects  are  graduate  students  at  the  Air  Force  Institute  of  Technology  and 
are  considered  to  have  a  high  degree  of  professionalism  and  integrity,  it  is  assumed  that 
this  will  be  the  case. 

Statistical  Analysis 

This  study  used  three  different  methods  to  analyze  the  data  and  test  the 
hypotheses.  The  overall  difference  in  treatments  was  tested  by  using  a  one-way  ANOVA 
and  students  t-test,  while  a  regression  analysis  was  used  to  gain  a  greater  understanding  of 
the  differences  in  treatment  factors  and  to  test  Hypothesis  1,  Hypothesis  2,  and 
Hypothesis  3.  These  tests  were  conducted  using  the  results  (PEA)  from  round  two,  which 
included  all  the  treatment  groups.  Finally,  a  paired  t-test  was  used  to  test  Hypothesis  4 
using  the  results  from  round  one.  Furthermore,  the  percent  equilibrium  attainment  (PEA) 
was  used  as  the  primary  means  of  measure  in  all  tests. 

Summary 

This  chapter  outlined  the  basic  research  design  of  the  study.  It  also  provided  a 
description  of  the  IW  Game  and  how  it  was  used  to  gather  the  data  necessary  for  the 
testing  of  the  hypotheses.  Finally,  this  chapter  provided  a  brief  preview  of  the  various 
statistical  methods  that  were  used  to  test  the  hypotheses. 
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IV.  Results  and  Analysis 


Introduction 

Chapter  III  depicted  the  methodology  used  to  conduct  the  experiment  and  collect 
data  to  test  the  hypotheses  for  this  study.  This  chapter  is  presented  in  two  sections.  First 
it  will  describe  the  statistical  analysis  used  to  test  the  hypotheses.  Secondly  it  will  report 
the  results  of  the  analysis. 

Description  of  Statistical  Analysis 

Hypotheses  1  through  3  were  tested  by  conducting  an  analysis  of  variance  based 
on  the  mean  percent  equilibrium  attainment  scores.  Since  the  only  controlled 
independent  variables  in  the  experiment  are  whether  there  are  budgetary  constraints, 
whether  multi-strategy  selection  is  possible,  and  whether  the  opponent  is  rational  or 
irrational,  this  is  a  so-called  three-factor  experiment  (McClave,  Benson,  Sincich,  1999). 
The  full  factorial  design  produces  eight  factor-level  combinations  (treatments).  The 
dependant  variable  was  the  subject’s  percentage  of  equilibrium  attainment  and  ranged 
between  0.0  and  1 .0  for  a  single  game.  The  experimental  unit  (EU)  for  this  experiment  is 
one  individual  playing  one  game.  The  observational  unit  (OU)  is  also  one  individual 
playing  one  game. 

The  analysis  of  variance  was  carried  out  by  using  two  separate  methods  of 
analysis.  Each  method  was  conducted  utilizing  a  significance  level  of  a  =  0.05.  Alpha 
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represents  the  chance  of  committing  a  Type  I  error  or  incorrectly  rejecting  the  null 
hypothesis  (H0  =  status  quo).  In  other  words,  there  is  a  five  percent  chance  of 
accidentally  accepting  the  alternative  hypothesis  (Ha  =  research  hypothesis)  when  in  fact 
there  is  no  significant  difference  in  the  treatment  groups.  All  tests  were  also  based  on  the 
assumptions  of  independence,  constant  variance,  and  normality. 

The  experiment  also  had  to  take  into  account  the  chance  of  producing  a  Type  II 
error,  which  is  defined  as  the  probability  of  concluding  that  the  null  hypothesis  is  true 
when  it  is  in  fact  false.  The  probability  of  committing  a  Type  II  error  is  equal  to  p.  The 
power  of  the  experiment,  which  is  defined  as  the  probability  of  the  test  correctly  leading 
to  the  rejection  of  the  null  hypothesis  for  a  particular  value  of  p  in  the  alternative 
hypothesis  is  equal  to  1  -  p.  Therefore,  any  increase  in  the  power  of  the  test  leads  to  an 
equal  decrease  in  P,  or  the  probability  of  committing  a  Type  II  error.  For  this  experiment, 
power  was  calculated  to  be  0.80  as  determined  by  a  combination  of  effect  size,  standard 
deviation  of  error  (sigma),  the  significance  level  (alpha),  and  sample  size  (Sail  and 
Lehman,  1996:  163). 

The  first  method  consisted  of  a  one-way  analysis  of  variance  using  the  Student’s  t. 
This  test  compares  the  means  of  each  treatment  group  to  determine  if  there  is  a  significant 
statistical  difference  in  their  value.  This  is  done  by  fitting  the  Y  variable  (Percent 
Equilibrium  Attainment)  to  the  X  variable  (Treatment  Group).  The  Y  variable  is 
continuous  and  can  take  on  a  value  between  0.0  and  1.0.  The  X  variable  is  categorical 
and  can  take  on  a  value  of  Treatment  1  through  Treatment  8.  The  ratio  of  variation 
between  each  treatment  group  was  measured  by  using  the  F-statistic.  The  F-statistic  was 
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considered  significant  (i.e.  that  there  was  a  significant  statistical  difference  between  the 
treatment  groups)  at  an  a  <  0.05. 

The  second  method  of  analysis  consisted  of  generating  a  multiple  linear 
regression  model  using  the  least  squares  approach.  This  was  conducted  to  determine  the 
significant  of  each  of  the  independent  variables  (budget,  multiple  strategies,  opponent 
Rationality)  in  relation  to  the  dependent  variable  (Percent  Equilibrium  Attainment).  Each 
of  the  independent  variables  were  coded  as  either  1  or  0,  which  represents  their  two 
possible  states  of  existence.  A  rejection  of  the  null  hypothesis  (indicating  an  effect  on  the 
dependent  variable)  should  generate  negative  coefficients  for  the  independent  variables. 

In  other  words,  the  presence  of  any  of  the  above  independent  variables  should  cause  a 
lower  percentage  of  equilibrium  attainment  on  the  part  of  the  subject. 

In  addition  to  the  above  dependant  variables  that  are  of  interest  to  this  study,  the 
regression  model  will  include  pre-test  (Game  1)  equilibrium  scores  and  information 
warfare  (IW)  experience  as  covariates.  This  is  in  keeping  with  the  original  IW  Game 
study  conducted  by  Burke  (1999).  The  original  study  attempted  to  use  a  pure  strategy 
game  average  score  to  account  for  a  player’s  innate  game  theoretic  rationality  in  a  mixed 
strategy  game.  This  study  will  attempt  to  account  for  innate  ability  by  using  the  pre-test 
equilibrium  scores  as  a  covariate  in  the  regression  analysis.  The  IW  experience  covariate 
accounts  for  a  player’s  prior  experience  in  information  warfare  and  should  produce  a 
positive  coefficient. 

The  overall  significance  of  the  model  in  each  analysis  method  was  assessed  using 
R2  as  the  multiple  coefficient  of  determination.  R2  measures  how  well  the  model  fits  the 
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data,  and  therefore,  provides  a  measure  of  the  overall  usefulness  of  the  model. 
Additionally,  R2  measures  the  explanatory  power  of  all  the  terms  included  in  the  model 
assuming  that  all  of  the  terms  are  present.  The  closer  R2  comes  to  1 .0  the  more 
explanatory  power  of  the  model. 

Hypothesis  4  was  tested  by  conducting  a  paired  t-test  on  the  equilibrium  results 
from  game  1 .  The  paired  t-test  tests  to  see  if  the  means  of  two  variables  are  the  same  at  a 
0.05  significance  level.  For  this  test,  the  variables  consisted  of  the  Percent  Equilibrium 
Attainment  score  (described  earlier)  and  the  NORRE  score  (as  developed  by  Burke)  for 
the  first  game.  However,  in  order  for  the  two  measures  to  be  directly  comparable,  the 
NORRE  score  had  to  be  converted  into  a  percentage.  This  was  done  by  using  the 
equation  (50  -  NORRE)/50  where  50  equals  the  total  rounds  in  the  game. 

Analysis  Results 

One-way  AN OVA  -  Student’ s-t 

Figure  3  on  the  following  page  provides  a  graphical  representation  of  the  Y 
response  variable  (percent  equilibrium  attainment)  plotted  against  the  treatment  groups 
for  round  two.  The  graphic  clearly  shows  a  decreasing  trend  in  equilibrium  attainment  as 
the  different  constraints  are  added.  Treatment  Group  1,  which  acted  as  the  control  group 
had  a  mean  equilibrium  attainment  of  67  percent  while  Treatment  Group  8  had  a  mean 
equilibrium  attainment  of  only  38  percent.  The  means  for  all  treatment  groups  along  with 
the  standard  error  calculated  in  the  analysis  of  variance  can  be  found  in  Table  6.  Note,  a 
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one-way  ANOVA  was  also  conducted  using  round  one  (Pre-Test)  results  and  found  no 
statistical  difference  between  the  treatment  groups. 


Figure  3.  Equilibrium  Attainment  vs  Treatment  Group 


The  one  way  analysis  of  variance  and  students  t-test  show  that  there  is  a 
significant  difference  between  the  mean  equilibrium  attainment  of  Treatment  Group  1 
(the  control  group)  with  that  of  Treatment  Groups  3,4,5, 6, 7,  and  8)  at  a  <  0.05.  This 
seems  to  suggest  that  budget  constraints  and  /  or  multiple  strategy  selection  significantly 
affect  a  player’s  ability  to  identify  and  play  the  equilibrium  strategy.  There  was,  however, 
no  significant  difference  between  Treatment  Groups  1  and  2.  This  suggests  that  an 
opponent’s  rationality  had  no  effect  on  a  player’s  ability  to  find  and  play  the  equilibrium 
strategy.  To  find  out  exactly  how  and  to  what  degree  budgetary  constraints  and  multiple 
selection  effect  equilibrium  attainment,  a  regression  analysis  had  to  be  performed. 
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Table  6.  Equilibrium  Attainment  Means  per  Treatment  Group 


Level 

Mean 

Std.  Error 

Treatment  1 

0.670 

0.6311 

Treatment  2 

0.562 

0.6311 

Treatment  3 

0.436 

0.6311 

Treatment  4 

0.476 

0.6311 

Treatment  5 

0.478 

0.6311 

Treatment  6 

0.456 

0.6311 

Treatment  7 

0.398 

0.6311 

Treatment  8 

0.384 

0.6311 

Standard  Error  uses  a  pooled  estimate  of 
error  variance 

Multiple  Regression  Analysis 

This  section  presents  the  results  of  the  regression  analysis  and  serves  as  the 
primary  basis  for  support  or  rejection  of  the  Hypotheses  1,  2,  and  3.  The  full  model 
includes  both  the  IW  experience  and  game  one  equilibrium  attainment  covariates  along 
with  the  three  primary  treatment  factors  and  their  interactions.  The  23  percent  of  the 
variation  in  equilibrium  attainment  accounted  for  by  the  model  should  be  sufficient  for 
assessing  the  stated  hypotheses.  The  beta  coefficient  for  each  variant  along  with  its 
associated  significance  level  is  presented  in  Table  7  on  the  following  page. 
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Table  7.  Regression  Analysis 


Independent  Variables 

Beta 

Coefficient 

Significance 
Level  ! 

IW  Experience. 

0.078 

0.149 

Percent  Equilibrium  Attainment  (PEA)  1 

-0.260 

0.083  ; 

Rationality 

-0.133 

0.134 

Budget 

-0.220 

0.017 

Multiple 

-0.251 

0.005 

Rational  *  Budget 

0.143 

0.259 

Rational  *  Multiple 

0.168 

0.180 

Budget  *  Multiple 

0.162 

0.194 

Rationality  *  Budget  *  Multiple 

-0.179 

0.310 

Though  not  a  primary  focus  of  this  study,  the  significance  of  the  two  covariates 
will  be  discussed  first.  A  review  of  the  regression  results  shows  that  prior  experience  with 
information  warfare  did  not  have  a  significant  impact  on  equilibrium  attainment  at  a  < 
0.05.  This  differs  from  the  results  reported  by  Burke  (1999)  who  did  find  a  significant 
increase  in  equilibrium  attainment  due  to  prior  information  warfare  experience.  The  data 
does  show  moderate  support  for  the  second  covariate,  which  sought  to  account  for  innate 
game  theoretic  ability  of  the  players. 

A  cursory  look  at  the  regression  table  shows  that  all  three  treatment  factors 
(Rationality,  Budget,  Multiple)  had  negative  effects  on  the  attainment  of  equilibrium. 

This  is  evident  by  the  negative  signs  of  their  beta  coefficients.  Budgetary  constraints  and 
multiple  strategy  selection  both  had  particularly  strong  effects  with  significance  values 
less  than  0.05.  Therefore,  the  evidence  supports  rejecting  the  null  hypotheses  for  both 
Hypothesis  1  and  Hypothesis  2  at  a  <  0.05.  However,  there  is  only  weak  support  that 
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opponent  rationality  had  any  effect  on  equilibrium  attainment.  Therefore,  the  null 
hypothesis  for  Hypothesis  3  cannot  be  rejected  at  a  <  0.05.  Interactions  between  the 
treatment  factors  were  also  tested  but  none  showed  significance. 


Paired  t-Test 

Hypothesis  4  was  tested  using  a  Paired  t-Test  to  determine  if  there  was  a 
significant  difference  in  the  mean  level  of  equilibrium  attainment  dependent  on  the  type 
of  calculation  used.  The  results  of  the  test,  along  with  a  graphical  representation  are 
depicted  in  Figure  4.  Specifically  the  results  show  that  the  null  hypothesis  (i.e.,  that  there 
is  no  significant  difference  in  the  means)  can  be  rejected  at  a  <  0.05. 


Figure  4.  Paired-t  Test 


The  bold  line  on  top  shows  the  points  where  the  two  variables  are  equal.  The  set 
of  thin  lines  below  show  the  95  percent  confidence  interval  of  the  mean  difference.  If  the 
bold  line  was  inside  of  the  confidence  interval,  it  would  indicate  that  there  was  no 
difference  in  the  means.  However,  in  light  of  the  apparent  mean  difference  of  0.34,  the 
null  hypothesis  is  rejected  and  Hypothesis  4  is  supported. 

Summary 

This  chapter  described  the  statistical  analysis  used  to  test  the  hypotheses.  It  the 
reported  the  results  of  the  analysis  conducted  on  the  experimental  data.  The  analysis 
found  strong  support  for  Hypotheses  1, 2,  and  4  but  could  only  find  weak  support  for 
Hypothesis  3.  The  implications  for  these  results  will  be  explored  in  the  next  chapter. 
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V.  Discussion 


Introduction 

The  last  chapter  reported  the  results  of  this  study’s  experiment  as  they  related  to 
the  stated  hypotheses.  This  section  will  look  at  the  implications  of  those  results  in  further 
detail.  Additionally,  some  of  the  limitations  of  this  study  and  recommendations  for  future 
research  are  discussed.  Finally,  concluding  remarks  are  given  to  close  out  the  study. 

Hypothesis  1  -  Multiple  Strategy  Selection 

The  results  reported  in  Chapter  IV  show  strong  support  for  Hypothesis  1 .  That  is, 
the  ability  of  a  player  to  choose  multiple  strategies  at  once  tended  to  have  a  negative 
effect  on  a  player’s  ability  to  find  and  play  the  equilibrium  strategy  (see  Figure  5).  This  is 
consistent  with  the  work  of  Malhotra  (1982),  Best  and  Ursic  (1987),  and  Helgeson  and 
Ursic  (1993),  who  all  found  that  the  number  of  alternatives  available  had  a  negative  effect 
on  the  accuracy  of  decision-making.  This  inability  to  make  accurate  decisions  when 
faced  with  a  growing  number  of  alternatives  could  have  an  impact  on  the  effectiveness  of 
strategies  chosen  by  IT  professionals  seeking  to  protect  our  nation’s  critical  information 
systems. 
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Figure  5.  Multiple  Strategies  vs.  PEA  Game  2 


Support  for  Hypothesis  1  indicates  that  a  decision  maker’s  effort  of  trying  to 
protect  everything  may  have  the  reverse  effect  of  not  protecting  anything  to  the  desired 
degree.  This  suggests  that  it  may  be  best  to  determine  what  type  of  information  is  most 
important  and  to  concentrate  our  defensive  strategies  on  it.  Of  course,  this  will  be 
dependent  upon  the  specific  system  being  protected  and  shows  that  a  cookie  cutter 
strategy  of  protecting  everything  regardless  of  “type”  will  not  work.  For  example,  if  a 
system  has  top  secret  information  on  it  that  could  cause  grave  and  serious  harm  to  the 
national  security  of  the  United  States,  then  it  may  by  better  to  concentrate  on  the 
confidentiality  of  the  system  instead  of  its  availability.  Trying  to  ensure  that  the  system  is 
available  1 00  percent  of  the  time  and  easily  accessible  to  its  users  could  compromise  the 
confidentiality  of  the  system  and  subsequently  cost  American  lives. 
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Hypothesis  2  -  Budgetary  Constraints 


The  results  also  found  strong  support  for  Hypothesis  2,  that  budgetary  constraints 
placed  on  a  player  had  a  negative  effect  on  his  or  her  ability  to  find  and  play  the 
equilibrium  strategy  (see  Figure  6).  It  is  important  to  remind  the  reader  that  each  player 
had  more  than  sufficient  funds  to  consistently  play  the  equilibrium  strategy.  Interestingly, 
it  was  most  often  best  for  the  player  to  choose  the  least  expensive  strategy  available  to 
him  or  her.  This  provides  some  interesting  insight  into  how  differing  strategies  are 
judged  based  on  price. 


Figure  6.  Budgetary  Constraints  vs.  PEA  Game  2 


Consistently  throughout  the  course  of  play,  subjects  who  had  to  purchase 
strategies  tended  to  choose  more  expensive  strategies  than  were  needed.  This  suggests 
that  players  believed  that  the  more  expensive  strategies  were  somehow  better  than  the  less 
expensive  strategies.  However,  this  assumption  on  the  part  of  the  players  had  no  basis  in 
fact.  Repeated  losses  should  have  helped  the  player  to  eventually  come  to  this 
realization;  however,  it  may  have  taken  more  time  than  the  50  turns  allotted. 
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Throughout  the  Department  of  Defense  and  other  agencies  of  the  federal 
government,  strategies  are  almost  never  considered  without  some  emphasis  on  their  cost. 
The  results  of  this  study  show  that  the  human  mind  may  tend  to  automatically  equate 
more  expensive  with  more  effective.  That  is,  if  the  most  expensive  strategy  is  chosen,  the 
most  effective  results  will  be  obtained.  However,  this  is  not  always  the  case,  and  the 
study’s  results  suggest  that  when  evaluating  differing  strategies,  information  technology 
professionals  may  want  to  first  look  at  the  merits  of  each  strategy  without  regard  to  cost. 
Nothing  here  suggests  that  cost  should  not  be  considered,  only  that  measures  of 
effectiveness  must  be  looked  at  first.  This  way,  a  strategy  may  be  chosen  which  best 
protects  our  systems  within  the  budgetary  constraints  imposed. 

Hypothesis  3  -  Opponent  Rationality 

The  data  collected  for  this  study  does  not  support  the  hypothesis  that  opponent 
rationality  has  a  significant  effect  on  a  person’s  ability  to  find  and  play  the  equilibrium 
strategy  at  a  <  0.05.  However,  as  depicted  in  Figure  7,  the  rationality  of  an  opponent 
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Figure  7.  Opponent  Rationality  vs.  PEA  Game  2 
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does  have  a  slightly  negative  effect  if  a  player  is  facing  someone  that  is  making  seemingly 
irrational  decisions  at  a  <  0.15.  Although  this  study  found  no  significant  effect  at  the 
desired  a  <  0.05,  the  outcome  does  provide  some  impetus  for  further  research  in  the  area. 

If  further  studies  also  find  no  significant  effect,  it  could  mean  that  the  human 
mind  does  not  generally  have  a  problem  devising  rational  solutions  in  response  to 
irrational  behavior.  Taken  another  way,  it  is  possible  for  us  to  develop  logical  defenses 
for  our  information  systems  even  though  we  do  not  know  who  is  attacking  them  or  for 
what  purpose.  We  do  not  need  to  develop  an  irrational  response  by  hampering  the  free 
flow  of  unclassified  information  or  completely  tightening  the  security  to  our  systems  to  a 
point  that  it  denies  access  to  legitimate  users.  This  would  be  consistent  with  our 
experience  in  dealing  with  international  and  domestic  terrorism,  which  provides  a  good 
example  for  this  scenario. 

Most  people  would  associate  fundamentalist  terrorism  with  irrational  behavior. 
This  is  because  the  perpetrators  generally  have  little  regard  for  human  life  including  their 
own.  Additionally,  those  trying  to  defend  against  it,  never  really  know  when  or  why  the 
perpetrators  will  strike  next.  Therefore,  even  if  the  terrorist’ s  actions  seem  and  are 
rational  to  them,  to  us  they  seem  irrational.  Nevertheless,  the  U.S.  manages  to  devise 
rational  methods  to  defend  against  terrorism  using  sound  practices  of  security  and  law 
enforcement. 

Unfortunately,  our  defenses  are  not  always  100  percent  effective,  but  in  the  long 
run  we  maximize  payoffs  to  society  by  ensuring  the  relative  safety  of  our  citizens  while 
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maintaining  an  open  society.  This  is  in  contrast  to  an  irrational  response  such  as 
declaring  a  police  state  and  indefinitely  suspending  individual  rights  in  order  to 
completely  eradicate  the  threat.  The  irrational  response  may  have  short  run  benefits  in  the 
fight  against  terrorism  but  in  the  long  run  it  would  be  devastating  to  our  way  of  life  and 
the  fundamentals  of  democracy. 

Hypothesis  4  -  Equilibrium  Calculations 

Hypothesis  4  looked  at  the  calculation  used  as  the  main  instrument  of  measure  in 
the  information  warfare  model.  Specifically,  it  asked  whether  calculating  equilibrium 
attainment  as  a  percentage  of  total  rounds  played  (PEA)  accounts  for  more  equilibrium 
attainment  (by  a  player)  then  counting  the  number  of  rounds  to  reach  equilibrium 
(NORRE)  as  performed  in  the  original  study  by  Burke  (1999).  The  analysis  found  strong 
support  for  this  hypothesis,  concluding  that  a  mean  difference  of  0.34  exists  between  the 
equilibrium  accounted  for  using  the  PEA  than  the  NORRE.  Therefore,  it  is 
recommended  that  any  future  study  use  the  PEA  method  of  calculation.  This  allows  the 
experimenter  to  calculate  exactly  how  close  a  subject  came  to  the  playing  the  equilibrium 
strategy  even  in  a  mixed  strategy  game. 

Study  Limitations 

Throughout  the  course  of  this  study,  a  few  limitations  became  apparent.  The  first 
limitation  comes  in  the  assumption  that  there  are  only  two  players  (attacker  and  defender) 
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in  any  given  game.  The  second  limitation  is  based  in  the  way  monetary  constraints  were 
integrated  into  the  game.  The  third  limitation  is  inherent  to  game  theory  itself. 

In  regards  to  the  first  limitation,  the  assumption  of  only  two  players  probably  is 
not  always  the  case  in  real  life.  Specifically,  for  any  given  defender  in  information 
warfare,  there  could  be  multiple  attackers  using  different  methods.  Furthermore,  each  of 
these  attackers  could  have  differing  objectives,  which  could  affect  their  utility 
maximization.  For  instance,  the  United  States  military  information  systems  face  threats 
from  a  myriad  of  vastly  different  types  of  attackers  at  any  point  in  time.  Telling  the 
difference  between  the  types  and  reacting  appropriately  is  a  significant  obstacle.  One 
type  of  attacker  may  be  a  foreign  espionage  agency  trying  to  steal  secrets.  Another 
attacker  at  the  same  point  in  time  could  be  a  teenage  hacker  that  just  wants  to  overcome  a 
challenge.  Not  knowing  which  type  of  attacker  it  is  may  hamper  the  development  of  an 
appropriate  response. 

As  for  the  second  limitation,  it  became  apparent  that  the  players  might  have 
disassociated  to  a  degree  the  purchasing  of  strategies  and  the  loss  of  information  during 
an  attack.  This  is  probably  because  the  payoff  a  defender  received  (lost)  when  a 
defensive  strategy  failed  was  dependent  entirely  on  the  strategy  chosen  by  the  attacker. 
Even  though  the  defender  spent  money  out  of  the  IW  budget  on  purchasing  defensive 
strategies,  he  or  she  did  not  see  it  translate  directly  into  the  payoff. 

The  third  limitation  of  this  study  involves  the  assumption  of  a  Nash  equilibrium  in 
information  warfare.  Remember,  that  an  equilibrium  strategy  is  one  that  the  player  should 
use  every  time  in  order  to  maximize  his  or  her  payoffs.  Though  this  was  the  case  for  the 
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payoffs  in  this  study,  it  may  not  be  the  case  in  all  situations  involving  information 
warfare. 

Recommendations  for  Further  Research 

Recommendations  for  further  research  stem  directly  from  the  limitations 
discussed  previously.  Specifically,  any  future  research  should  include  a  closer  integration 
of  strategy  cost  with  the  actual  payoff  received  by  a  player.  In  other  words,  any  payoff 
received  by  the  player  should  be  reduced  by  the  cost  of  the  chosen  strategy.  This  could 
also  be  done  prior  to  the  calculation  of  expected  payoff  so  that  it  is  linked  to  the 
equilibrium  strategy  as  well. 

A  future  study  could  also  integrate  multiple  players  into  the  IW  game  model. 
Although  most  game  theoretic  models  use  only  two  players,  theoretically  a  game  model 
could  have  an  infinite  amount  of  players.  Zagare  (1984:  64)  points  out,  however,  that 
games  of  this  type  are  both  “quantitatively  and  qualitatively  different  from  two  person 
games”.  He  points  specifically  to  the  fact  that  once  more  than  two  players  are  involved  in 
a  game,  the  possibility  of  a  coalition  arises.  This  possibility  also  seems  to  be  evident  in 
information  warfare  where,  for  example,  an  international  criminal  organization  could  find 
common  ground  with  a  rogue  nation  opposed  to  the  United  States. 

Conclusion 

This  study  has  provided  significant  enhancements  to  the  information  warfare 
game  model  to  more  accurately  represent  the  realities  of  information  warfare.  In  addition, 
it  has  provided  further  confirmation  that  the  model  is  a  useful  method  of  analyzing  human 
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behavior  and  the  decisions  of  those  engaged  in  strategy  formulation  for  information 
warfare.  It  has  shown  that  both,  the  ability  to  choose  multiple  strategies  and  the  existence 
of  budgetary  constraints  have  a  significant  negative  effect  on  a  person’s  ability  to  make 
accurate  decisions  about  information  warfare  strategies.  It  has  also  provided  hope  that  we 
can  develop  rational  responses  to  what  looks  like  irrational  attacks  against  our  systems. 
Finally,  it  has  provided  a  more  robust  method  of  measuring  a  subject’s  attainment  of 
equilibrium  thus  allowing  for  more  accurate  results  in  the  analysis  of  the  data. 

There  is  still  much  work  to  be  done  in  this  field  and  in  the  development  of  the  IW 
model.  It  is  hoped  that  others  will  carry  on  this  work  and  develop  more  enhancements  to 
the  model  which  will  further  our  understanding  of  information  warfare  and  human  nature 
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Appendix  A:  Experiment  Instructions 


Instructions 

Thank  you  for  participating  in  this  experiment.  This  experiment  involves  playing  a  simple  Information 
Warfare  (IW)  based  game.  Please  do  not  use  writing  materials,  calculators,  or  other  external  devices  while 
playing  the  game.  Also,  please  do  not  have  any  other  software  applications  open  on  your  computer  during 
the  experiment.  Please  do  not  speak  to  other  subjects  during  or  after  the  experiment  (in  particular,  do  not 
reveal  your  strategies  or  winnings/losses).  Finally,  please  read  all  instructions,  scenario,  and  the  help  page 
completely.  After  you  have  read  all  the  pages  you  will  be  asked  to  answer  a  few  simple  questions  to  ensure 
your  comprehension  of  the  experiment.  Thank  you  for  your  cooperation. 


If  you  encounter  a  software  error  that  stops  you  from  proceeding  during  the  experiment,  please  close 
the  software  and  notify  the  experimenter  at  steven .  tait@afit .  af.  mi  1  .  Likewise,  if  you  have  any 
questions  please  notify  the  experimenter. 


The  purpose  of  this  experiment  is  to  test  and  validate  a  game  theory  model  with  various  aspects  of 
information  warfare.  Game  theory  is  a  technique  frequently  used  in  economics  and  other  social  sciences  to 
model  social  behavior.  The  primary  motivation  for  developing  a  game  theory  model  is  to  simplify  complex 
situations.  The  simplified  model  can  then  allow  better  understanding  of  people’s  actions  and  the  reason(s) 
for  their  actions. 


Your  goal  is  to  maximize  your  payoff  while  minimizing  your  losses  -  REGARDLES  OF  WHAT 
PREVIOUS  IW  EXPERIENCE  MAY  INDICATE. 


Each  of  you  will  have  three  strategies  available.  These  strategies  will  be  explained  on  the  following 
Scenario  Page.  Your  overall  goal  is  to  determine  and  employ  the  combination  of  strategies  that  yields  you 
the  best  long-term  payoff.  Under  some  conditions,  it  may  be  advantageous  to  use  a  combination  of  two  or 
all  three  strategies  in  response  to  your  opponent’ s  strategies.  At  other  times,  it  may  be  better  to  use  only 
one  strategy.  During  the  first  few  turns  you  should  complete  the  following  actions: 
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1)  Determine  your  best  strategy(s),  i.e.  those  that  seem  to  succeed  most  often  and  that  yield  the  best  long¬ 
term  payoff. 

2)  If  no  single  strategy  seems  best,  determine  the  combination  of  strategies  that  yields  higher  long-term 
payoffs. 

3)  Attempt  to  determine  the  preferred  strategy(s)  of  your  opponent  and  alter  your  strategy  accordingly. 

4)  When  you  believe  you  have  found  the  best  strategy  or  combination  of  strategies,  continue  using  it 
unless  your  overall  payoffs  seriously  decline. 
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Appendix  B:  Basic  Scenario 


Scenario 


You  are  the  Chief  Information  Officer  (CIO)  for  the  United  States  Air  Force.  From  your  latest 
meeting  with  senior  intelligence  advisors  and  the  FBI,  you  learned  that  Air  Force  information 
systems  are  being  targeted  by  a  foreign  adversary.  Their  goal  is  to  use  information  operations  to 
counter  the  military  advantage  held  by  the  United  States. 


You  have  since  learned  that  there  are  three  potential  strategies  available  to  your  adversary.  The 
opposing  states  will  either  try  to  attack  the  integrity  of  Air  Force  information  systems,  to  affect 
the  availability  of  Air  Force  information  systems  or  they  will  try  to  attack  the  confidentiality  of 
Air  Force  information  systems.  Each  of  these  are  strategies  and  the  operations  to  achieve  them 
are  explained  below.  Each  month  your  adversary  will  devote  all  of  its  resources  to  one  or  none 
of  these  strategies. 

1.  Integrity  Attack:  The  goal  of  this  strategy  is  often  to  affect  the  operations  of  the  system 
without  the  knowledge  of  the  user.  This  strategy  involves  operations  that  penetrate  the 
information  systems,  tamper  with  the  systems,  and  fabricate  data  within  the  systems. 

2.  Availability  Attack:  This  type  of  attack  is  commonly  known  as  a  denial  of  service  attack.  It 
differs  from  an  integrity  attack  in  that  it  overtly  halts  operations  instead  of  controlling  the 
output  of  operations.  It  takes  the  form  of  three  types  of  operations:  physical  theft  of  hardware, 
sabotage  either  physically  or  logically,  and  censorship. 

3.  Confidentiality  Attack:  The  goal  of  a  confidentiality  attack  is  to  gather  sensitive 
information.  Five  different  types  of  operations  attain  this  outcome:  espionage  and  intelligence 
operations,  information  piracy,  penetration  into  physical  premises  and  computer  systems, 
superimposition  fraud,  and  identity  theft. 


Your  Information  Security  department  has  developed  defensive  strategies  to  counter  each  of  the 
above  attacks.  Each  month,  you  will  select  one  or  none  of  these  strategies  to  employ.  Although 
each  defense  strategy  counters  a  specific  attack,  they  also  have  limited  effectiveness  against  the 
other  attack  strategies.  Your  defense  strategies  are  not  cumulative.  Thus,  you  will  begin  anew 
each  month.  At  the  end  of  each  month,  you  will  receive  a  report  indicating  the  costs  of  any 
information  resources  that  were  compromised. 
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Appendix  C:  Help  Screen 


DEFENDER  GAME  HELP 

PAYOFF  MATRIX 


The  Payoff  Matrix  indicates  the  costs  of  compromised  information  resources  when  a  particular  Defense 
Strategy  fails.  The  actual  cost  depends  upon  the  Defense  Strategy  chosen  and  the  Attacker’s  Strategy.  The 
sample  payoff  matrix  below  shows  that  you  will  lose  $70Million  if  your  Integrity  Defense  Strategy  fails 
against  a  Integrity  Attack.  However,  if  your  Integrity  Defense  succeeds,  you  lose  nothing.  Two  important 
items  should  be  noted  here.  First,  when  your  Defense  strategy  succeeds,  the  Attacker  gains  nothing. 
However,  when  your  Defense  Strategy  fails,  the  Attacker  may  or  may  not  gain  the  same  amount  that  you 
have  lost  (i.e.  this  is  not  a  zero-sum  game).  In  the  below  example,  if  your  Integrity  Defense  strategy  fails 
and  you  lose  $70Million,  the  Attacker  may  only  realize  a  gain  of  $50Million.  Indeed,  the  Attacker’s  payoff 
matrix  may  look  much  different  than  yours.  Thus ,  you  should  not  immediately  assume  that  the  Attacker 
values  their  strategies  in  the  same  way  that  you  do . 


Integrity 

Defense 

Availability 

Defense 

Confidentiality 

*/ 

Defense 

Integrity  Attack 

-70 

-70 

-70 

Availability  Attack 

-50 

-50 

-50 

Confidentiality  Attack 

-25 

-25 

-25 

Notice  that  if  your  defense  strategy  does  fail,  you  will  be  able  to  determine  the  strategy  that  the  Attacker 
used  by  noticing  how  much  money  you  lost.  In  the  above  example  you  would  be  able  to  determine  that 
your  opponent  used  an  Integrity  Attack. 

STRATEGY  SUCCESS 

Although  you  cannot  directly  select  your  own  payoff,  you  will  quickly  notice  which  of  your  strategies  are 
more  effective  {i.e.  those  that  succeed  more  often).  Additionally,  your  Defense  Strategies  are  more 
effective  against  some  attacks  than  they  are  against  others.  Thus,  your  Integrity  Defense  may  be  very 
effective  against  a  Integrity  Attack,  but  only  moderately  effective  against  a  Availability  Attack. 

The  “Approximate  Chance  of  Success”  area  of  your  Game  screen  shows  the  averaged \  approximate  chance 
of  success  for  each  of  your  strategies.  THESE  VALUES  ARE  ONLY  A  GUIDE  TO  HELP  GET  YOU 
STARTED.  You  will  notice  that  Defense  Strategies  are  more  effective  against  particular  types  of  Attacks. 
Additionally,  you  should  notice  that  a  Defense  Strategy  with  a  low  overall  chance  of  success  may  be  very 
effective  against  one  type  of  attack.  For  instance,  the  Confidentiality  Defense  may  be  very  effective  against 
the  Confidentiality  Attack  (60%  or  better)  but  ineffective  against  other  attacks  (25%  or  worse). 

A  KEY  FACTOR  IN  SELECTING  THE  BEST  STRATEGY  IS  DETERMINING  WHEN  YOUR 
DEFENSE  STRA  TEGJES  ARE  MOST  EFFECTIVE. 
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TOOLS  HELP 


Average  Payoff  boxes,  one  for  each  move,  have  been  place  on  the  upper,  right-hand  side  of  the  Game  Form. 
These  boxes  show  the  average  payoff  for  each  move,  averaged  over  the  number  of  turns  that  you  have 
played  the  move.  Each  box’s  average  is  updated  after  you  use  that  move.  The  example  below  shows  how 
this  works: 

Suppose  that  you  have  played  5  turns  so  far,  as  shown  in  the  table  below:  (NOTE:  All  strategies 
will  be  shown  on  the  game  form) 


TURN 

MOVE 

PAYOFF 

RECEIVED 

AVERAGE  PAYOFFS 

1 

Availability  Def. 

0 

Availability  Def.  =  0 

Integrity  Def.  -  0 

2 

Integrity  Def. 

-75 

Availability  Def.  ~  0 

Integrity  Del. ™  -75 

3 

Availability  Def. 

-25 

Availability  Def.  =  -12.5 

Integrity  Def  -  -75 

4 

Integrity  Def 

0 

Availability  Def.  =  -12.5 

Integrity  Def  -  -37.5 

5 

Integrity  Def 

-50 

Availability  Def  =  - 1 2.5 

Integrity  Def.  =  -41.67 

Since  your  goal  is  to  lose  as  little  as  possible,  you  should  favor  strategies  that  have  an  Average  Payoff  close 
to  zero.  Keep  in  mind  that  the  Average  Payoff  will  become  more  accurate  as  more  turns  are  pi  eyed. 

Below  the  Average  Payoff  boxes  is  a  scroll-box  that  shows  the  moves  and  payoffs  for  each  turn  of  the 
game.  This  box  allows  you  to  see  what  moves  you  have  made  previously  and  what  payoff  you  received  for 
those  moves. 
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Appendix  D:  Questionnaire 


► 


Questionnaire 


What  ate  the  three  posfcle  strategies 
employed  by  your  adversary,  which  you  must 
defend  against? 


$  [Integrity,  Coersion,  Confidentiality  Attack 
$  Coersion,  Availability.  Confidentiality  Attack 
#  Integrity.  Availability,  Confidentiality  Attack 


Your  aponents  payoff  is  always  equal  to  your 
loss  (zero  sum  game}? 


$  True 
£  False 


The  goal  of  a  confidentiality  attack  on  an  Air  |  £ 

Force  system  is  to  gather  sensitive 

information?  j  $  False 


The  goal  of  the  game  is  to? 


£  Defend  only  the  most  valuable  information 
£  Maximize  payoff  over  the  entire  game(least  $  loss] 
6  Use  the  most  information 


A  key  factor  r  choosing  a  defense  strategy  is  i  6?  True 

determining  when  your  defense  strategy  is 

most  effective?  ]  $  False 


Continue 
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Appendix  E:  Game  Forms 
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Full 


GameForm ;  Form 


Game  Form 

Payoff  Matrix 

Units  in  Miens.  US  $ 


DEFEND 


Integrity 

Availability 

Confidentiality 

None  | 

A  Integrity 

*50 

■50 

-50 

-50  j 

l!  Availibility 

♦35 

■35 

•35 

■35  | 

A' 

£  Confidentiality 

■50 

•75 

•75 

-75  | 

*  None 

0 

0 

mm 

n 

Average 

Approximate  Chances  of  Success  Payoff 


Integrity  Defense 

Better  than  752 

•62 

integrity  Availably  Defense 

Better  than  752 

0 

IntegntyXonfidentiaRy  Defense 

Better  than  752 

0 

Availably  Defense 

Better  than  502 

0 

Ava^iyXonfidentiaSty  Defense 

B^ter  than  75^  : 

0 

Confidentiality  Deterge 

0 

Better  than  752 

0 

Better  than  252 

0 

Select  Move:  |lntegityDefeme 

(Make  Move] 


Game  Help 


- 3 

Move  Cost 
j  -  ^300“ 

Av^lable  Funds: 

j  . 

Units  in  Thousands,  US  $ 


Previous  Month's  Payot?:  and  Moves 
Last  Month  Payoff:  |  0 

Move  Success  junsuccessfuli 
P^off  Received  |  ~g) 


Turn  lOefendActxyi 

t  Integrity  Defense 

■62  n 

2 

0 

3 

0 

4 

0 

5 

0 

6 

0 

7 

0 

8 

0 

9 

0 

10 

0 

11 

0 

12 

0 

13 

2  zl 

Vu 

Jj 

Total  Payoff  Receded 

1  -62 

Urals  in  Miiora.  US  $ 
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Appendix  F:  Visual  Basic  Code 


Option  Compare  Database 
Option  Explicit 

Private  Sub  Continue_Click() 

Dim  FindSubject  As  QueryDef 

Dim  SubjectRecord  As  Recordset,  ErrorRecord  As  Recordset 
Dim  Query  As  String 

Dim  Subject  As  Integer,  Counter  As  Integer 

On  Error  GoTo  ErrorHandler 

Begin: 


If  IsNull(SubjectNumber)  Then 

MsgBox  ’’Please  Select  Your  Name” 

Else 

Subject  =  SubjectNumber 

Query  =  ’’SELECT  *  FROM  Subjects  WHERE  SubjectID  ="  &  Subject 

Set  FindSubject  =  CurrentDb.CreateQueryDef("FindSubject”  &  Subject,  Query) 

Set  SubjectRecord  =  FindSubject. OpenRecordset 

SubjectRecord.MoveFirst 

DefenderBox  =  SubjectRecord(  "Defender”) 

RationalBox  =  SubjectRecord("Rational”) 

BudgetBox  =  SubjectRecord( ’’Budget") 

MultiBox  =  SubjectRecord(”Multi") 

SubjectRecord. Edit 

SubjectRecord(”IWExperience”)  =  IWExperience 
SubjectRecord(”GameExperience”)  =  GameExperience 
’SubjectRecord(”LastName")  =  LastNameBox 
’SubjectRecord("FirstName”)  =  FirstNameBox 
SubjectRecord.Update 

CurrentDb.QueryDefs.Delete  "FindSubject”  &  Subject 
CurrentDb.QueryDefs.Reffesh 

DoCmd.OpenForm  "GameForm" 

DoCmd.OpenForm  "Quiz” 

DoCmd.OpenForm  "DefenderHelp" 

If  MultiBox  =  True  Then 
If  BudgetBox  =  True  Then 

DoCmd.OpenForm  "MultiBudgetScenario" 

Else 

DoCmd.OpenForm  "MultiScenario" 

End  If 

Elself  BudgetBox  =  True  Then 
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DoCmd.OpenForm  "BudgetScenario1 


Else 

DoCmd.OpenForm  "DefenderScenario" 

End  If 

DoCmd.OpenForm  "Instructions" 

DoCmd.Maximize 

Forms!  Quiz  !SubjectBox  =  Subject 

DoCmd.Close  acForm,  "Subjectldentification" 

End  If 
GoTo  Out 

ErrorHandler: 

Set  ErrorRecord  =  CurrentDb.OpenRecordset("Errors",  DB  OPEN  DYNASET) 
With  ErrorRecord 
.AddNew 

IBlownUpCount  =  -1  ’  Indicates  that  Error  Occurred  on  Subject  ID  Form 
lErrorDesc  =  Err. Description 
!ErrorNumber  =  Err  .Number 
.Update 
End  With 

For  Counter  =  1  To  1000 
Next  Counter 
Resume  Begin 

Out: 

End  Sub 

Private  Sub  Form_Open(Cancel  As  Integer) 

DoCmd.Maximize 


End  Sub 


Private  Sub  FeaturesEtelpButtonClickQ 


DoCmd.OpenForm  "DefendToolsHelp" 

End  Sub 

Private  Sub  DmoveBox_Change() 

If  DMoveBox  =  "Integrity  Defense"  Then 
MoveCost  =  Strategy  ICostBox 
Elself  DMoveBox  =  "Availability  Defense"  Then 
MoveCost  =  Strategy2CostBox 
Elself  DMoveBox  =  "Confidentiality  Defense"  Then 
MoveCost  =  Strategy  3  CostBox 
Elself  DMoveBox  =  "Integrity,  Availability  Defense"  Then 
MoveCost  =  Strategy  ICostBox  +  Strategy2CostBox 
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Elself  DMoveBox  =  "Integrity, Confidentiality  Defense"  Then 
MoveCost  =  Strategy  ICostBox  +  Strategy3CostBox 
Elself  DMoveBox  =  "Availability, Confidentiality  Defense"  Then 
MoveCost  =  Strategy2CostBox  +  Strategy3CostBox 
Elself  DMoveBox  =  "Integrity, Availability, Confidentiality  Defense"  Then 
MoveCost  =  Strategy  ICostBox  +  Strategy2CostBox  +  Strategy3CostBox 
Else:  MoveCost  =  0 

End  If 
End  Sub 

Private  Sub  Form_Open(Cancel  As  Integer) 

Dim  Payoff  As  Integer 

Dim  i  As  Integer 

Dim  Subject  As  Integer 

Dim  Match  As  Integer 

Dim  Game  As  Integer,  BlownUp  As  Integer 

Dim  Defender  As  Boolean,  TableExists  As  Boolean,  Rational  As  Boolean,  Multi  As  Boolean,  Budget  As 
Boolean 

Dim  Move  1  Sum  As  Single,  Move2Sum  As  Single,  Move3Sum  As  Single,  Move4Sum  As  Single, 
MoveSSum  As  Single,  Move6Sum  As  Single,  Move7Sum  As  Single,  Move8Sum  As  Single 
Dim  Query  As  String 

Dim  PayoffRecord,  MatchRecord,  SuccessRecord,  TumRecord,  HistoryRecord  As  Recordset 
Dim  ErrorRecord  As  Recordset 

Dim  FindPayoff,  FindMatch,  FindSuccess  As  QueryDef 
Dim  MatchTable  As  TableDef 
Dim  MatchField  As  Field 

On  Error  GoTo  Common_Error 
BlownUp  “  0 

Begin: 

DoCmd  .Maximize 

Defender  =  Forms  !SubjectIdentification!DefenderBox 
Rational  =  Forms  !SubjectIdentification!RationalB  ox 
Multi  =  Forms!  SubjectldentificationlMultiBox 
Budget  =  Forms!  SubjectldentificationlBudgetBox 
Subject  =  Forms  !SubjectIdentification!SubjectNumber 
Forms!GameForm!DefenderBox  =  Defender 
Forms  !GameForm!RationalBox  =  Rational 
Forms!GameForm!MultipleBox  =  Multi 
Forms  !GameForm!BudgetaryBox  =  Budget 
Forms!GameForm!SubjectBox  =  Subject 
TurnBox  =  1 


MovelLabel.Caption  = 
Move2Label. Caption  = 
Move3Label.Caption  = 
Mo  ve4Label.  Caption  = 
MoveSLabel. Caption  = 
Move6Label.  Caption  = 


"Integrity  Defense" 

"Integrity, Availability  Defense" 
"Integrity, Confidentiality  Defense" 
"Availability  Defense" 

"Availability, Confidentiality  Defense" 
"Confidentiality  Defense" 
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Move7Label.Caption  =  ’’Integrity, Availability, Confidentiality  Defense” 
Move8Label. Caption  =  ’’None" 

’Set  text  color  to  Blue 
MovelLabel.ForeColor  =  16711680 
Move2Label.ForeColor  =  16711680 
Move3Label.ForeColor  =  16711680 
Move4Label.ForeColor  =  16711680 
Move5Label.ForeColor  =  16711680 
Move6Label.ForeColor  =  16711680 
Move7Label.ForeColor  =  16711680 
Move8Label.ForeColor  =  16711680 

Query  -  "SELECT  *  FROM  Matches  WHERE  Defender  ="  &  Subject 
DefendHistory.Visible  -  True 
DefendHistory. Enabled  =  True 


If  Multi  =  False  Then 

Move2Label.  Visible  =  False 
Move3Label.Visible  —  False 
Move5Label.Visible  =  False 
Move7Label.Visible  =  False 

Move2Success.Visible  =  False 
Move3Success.Visible  =  False 
Move5Success.Visible  =  False 
Move7Success.Visible  -  False 

Move2 Average. Visible  -  False 
Move3Average. Visible  =  False 
Move5Average.Visible  -  False 
Move7Average.  Visible  =  False 


SingleMoveBox.  Visible  =  True 
SingleMoveBox.Enabled  =  True 
SingleMoveBox.TabStop  =  True 


Elself  Multi  =  True  Then 


MultiMoveBox.  Visible  =  True 
MultiMoveBox.Enabled  =  True 
MultiMoveBox.TabStop  =  True 


End  If 

Set  FindMatch  =  CurrentDb.CreateQueryDef("FindMatch"  &  Subject,  Query) 

Set  MatchRecord  =  FindMatch.  OpenRecordset 

MatchRecord.MoveFirst 

Game  =  MatchRecord(’’GameID") 
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Match  =  MatchRecord("MatchID") 

GameBox  =  Game 
MatchBox  =  Match 

CurrentDb.QueryDefs.Delete  "FindMatch"  &  Subject 
CurrentDb.QueryDefs.  Refresh 

Query  =  "SELECT  *  FROM  Payoffs  WHERE  GamelD  ="  &  Game 
Set  FindPayoff  =  CurrentDb.CreateQueryDef("FindPayoff’  &  Subject,  Query) 
Set  PayoffRecord  =  FindPayoff. OpenRecordset 
PayoffRecord.FindFirst  "[Defender]  =  "  &  Defender 
A 1 D 1  Payoff  =  Str$(PayoffRecord("  A 1 D 1 ")) 

A 1  D2Payoff  =  Str$(PayoffRecord("  A 1 D2")) 

A 1 D3  Payoff  =  S  tr$  (PayoffRecord( "  A 1 D3  ")) 

A 1  D4Payoff  =  Str$(Pay  offRecord(  "A  1 D4  ")) 

A 1  DSPayoff  =  Str$(PayoffRecord("  A  IDS")) 

A 1  D6Payoff  =  Str$(PayoffRecord(  "A  1 D6 ")) 

A 1  D7Payoff  =  Str$(PayoffRecord("  A 1 D7")) 

A 1  D8Payoff  =  Str$(PayoffRecord("  A 1 D8")) 

A2D1  Payoff  =  Str$(PayoffRecord("A2Dl")) 

A2D2Payoff  =  Str$(PayoffRecord("  A2D2")) 

A2D3Payoff  =  Str$(PayoffRecord("  A2D3 ")) 

A2D4Payoff  =  Str$(PayoffRecord("  A2D4")) 

A2D5Payoff  =  Str$(PayoffRecord("A2D5")) 

A2D6Payoff  —  Str$(PayoffRecord("  A2D6")) 

A2D7Payoff  =  Str$(PayoffRecord("  A2D7")) 

A2D8Payoff  =  Str$(PayoffRecord("  A2D8")) 

A3D 1  Payoff  =  Str$(PayoffRecord("  A3D 1 ")) 

A3D2Payoff —  Str$(PayoffRecord("A3D2")) 

A3D3Payoff  =  Str$(PayoffRecord("A3D3")) 

A3D4Payoff=  Str$(PayoffRecord("A3D4")) 

A3D5Payoff=  Str$(PayoffRecord("A3D5")) 

A3D6Payoff  =  Str$(PayoffRecord("A3D6")) 

A3D7Payoff  =  Str$(PayoffRecord("A3D7")) 

A3D8Payoff  =  Str$(PayoffRecord("A3D8")) 

A4D 1  Payoff  =  Str$(PayoffRecord("  A4D 1 ")) 

A4D2Payoff  =  Str$(PayoffRecord("  A4D2")) 
A4D3Payoff=Str$(PayoffRecord("A4D3")) 

A4D4Payoff=  Str$(PayoffRecord("A4D4")) 

A4D5Payoff  =  Str$(PayoffRecord("A4D5")) 

A4D6Payoff  =  Str$(PayoffRecord("A4D6")) 

A4D7Payoff  -  Str$(PayoffRecord( " A4D7 ")) 

A4D8Payoff  =  Str$(PayoffRecord("A4D8")) 

A5D 1  Payoff  =  Str$(PayoffRecord("  A5D 1 ")) 

A5D2Payoff  =  Str$(PayoffRecord("A5D2")) 

A5D3Payoff  =  Str$(PayoffRecord("A5D3")) 

A5D4Payoff  =  Str$(PayoffRecord("A5D4")) 
A5D5Payoff=Str$(PayoffRecord("A5D5")) 

A5D6Payoff  =  Str$(PayoffRecord("A5D6")) 

A5D7Payoff  =  Str$(PayoffRecord("A5D7")) 

A5D8Payoff  =  Str$(PayoffRecord("A5D8")) 

A6D 1  Payoff  =  Str$(PayoffRecord("  A6D 1 ")) 

A6D2Payoff  =  Str$(PayoffRecord("  A6D2")) 

A6D3Payoff  =  Str$(PayoffRecord("A6D3")) 

A6D4Payoff  -  Str$(PayoffRecord(" A6D4")) 
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A6D5Payoff  = 
A6D6Payoff  = 
A6D7Payoff- 
A6D8Payoff  = 
A7D1  Payoff = 
A7D2Payoff  = 
A7D3Payoff = 
A7D4Payoff  = 
A7D5Payoff = 
A7D6Payoff  = 
A7D7Payoff= 
A7D8Payoff= 
A8D 1  Payoff = 
A8D2Payoff = 
A8D3Payoff  = 
A8D4Payoff = 
A8D5Payoff  = 
A8D6Payoff  = 
A8D7Payoff  = 
A8D8Payoff  = 


Str$(PayoffRecord("A6D5")) 
Str$(PayoffRecord("A6D6")) 
Str$(PayoffRecord("A6D7")) 
Str$(PayoffRecord("A6D8")) 
Str$(PayoffRecord("A7D  1 ")) 
Str$(PayoffRecord("A7D2")) 
Str$(PayoffRecord( "  A7D3  ")) 
Str$(PayoffRecord("A7D4")) 
Str$(PayoffRecord("A7D5")) 
Str$(PayoffRecord("A7D6")) 
Str$(PayoffRecord("A7D7")) 
Str$(PayoffRecord("A7D8")) 
Str$(PayoffRecord(nA8Dl M)) 
Str$(PayoffRecord("A8D2")) 
Str$(PayoffRecord("  A8D3  ")) 
Str$(PayoffRecord(”A8D4")) 
Str$(PayoffRecord(MA8D5")) 
Str$(PayoffRecord("A8D6")) 
Str$(PayoffRecord("A8D7")) 
Str$(PayoffRecord("A8D8")) 


CurrentDb.QueryDefs.Delete  "FindPayoff  &  Subject 
CurrentDb.QueryDefs.Refresh 

Query  =  ’’SELECT  *  FROM  Success  WHERE  GamelD  =”  &  Game 

Set  FindSuccess  =  CurrentDb.CreateQueryDef(  "FindSuccess"  &  Subject,  Query) 

Set  SuccessRecord  -  FindSuccess. OpenRecordset 

SuccessRecord.FindFirst  "[Defender]  =  "  &  Defender 

AlDlSuccess  -  Str$(SuccessRecord("AlDl")) 

AlD2Success  =  Str$(SuccessRecord("AlD2")) 

AlD3Success  =  Str$(SuccessRecord("AlD3")) 

AlD4Success  =  Str$(SuccessRecord("AlD4")) 

AlD5Success  =  Str$(SuccessRecord("AlD5")) 

AlD6Success  =  Str$(SuccessRecord("AlD6")) 

AlD7Success  =  Str$(SuccessRecord("AlD7")) 

AlD8Success  =  Str$(SuccessRecord("AlD8”)) 

A2D1  Success  =  Str$(SuccessRecord("A2Dl")) 

A2D2Success  =  Str$(SuccessRecord(”A2D2")) 

A2D3Success  =  Str$(SuccessRecord("A2D3")) 

A2D4Success  =  Str$(SuccessRecord("A2D4")) 

A2D5Success  =  Str$(SuccessRecord("A2D5")) 

A2D6Success  =  Str$(SuccessRecord("A2D6")) 

A2D7Success  -  Str$(SuccessRecord("A2D7")) 

A2D8Success  =  Str$(SuccessRecord("A2D8")) 

A3D1  Success  =  Str$(SuccessRecord("A3Dl")) 

A3D2Success  =  Str$(SuccessRecord("A3D2")) 

A3D3Success  =  Str$(SuccessRecord("A3D3")) 

A3D4Success  =  Str$(SuccessRecord("A3D4")) 

A3D5Success  =  Str$(SuccessRecord("A3D5")) 

A3D6Success  =  Str$(SuccessRecord("A3D6")) 

A3D7Success  =  Str$(SuccessRecord("A3D7")) 

A3D8Success  =  Str$(SuccessRecord("A3D8")) 

A4D1  Success  =  Str$(SuccessRecord("A4Dr')) 

A4D2Success  =  Str$(SuccessRecord("A4D2")) 
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A4D3Success  = 
A4D4Success  - 
A4D5Success  = 
A4D6Success  = 
A4D7Success  = 
A4D8Success  = 
A5D1  Success  = 
A5D2Success  = 
A5D3Success  = 
A5D4Success  = 
A5D5Success  = 
A5D6Success  = 
A5D7Success  = 
A5D8Success  = 
A6D1  Success  = 
A6D2Success  = 
A6D3Success  = 
A6D4Success  = 
A6D5Success  = 
A6D6Success  = 
A6D7Success  - 
A6D8Success  = 
A7D1  Success  = 
A7D2Success  = 
A7D3Success  - 
A7D4Success  = 
A7D5Success  = 
A7D6Success  = 
A7D7Success  = 
A7D8Success  = 
A8D1  Success  = 
A8D2Success  = 
A8D3Success  = 
A8D4Success  = 
A8D5Success  = 
A8D6Success  = 
A8D7Success  = 
A8D8Success  = 


Str$(SuccessRecord("A4D3")) 
Str$(SuccessRecord(MA4D4M)) 
Str$(SuccessRecord("  A4D5 ")) 
Str$(SuccessRecord(MA4D6")) 
Str$(SuccessRecord("A4D7M)) 
Str$(SuccessRecord(MA4D8")) 
Str$(SuccessRecord(MA5Dln)) 
Str$(SuccessRecord("A5D2")) 
Str$(SuccessRecord(M  A5D3 ")) 
Str$(SuccessRecord("A5D4")) 
Str$(SuccessRecord("A5D5")) 
Str$(SuccessRecord("A5D6")) 
Str$(SuccessRecord("A5D7")) 
Str$(SuccessRecord("A5D8")) 
Str$(SuccessRecord("  A6D 1 ")) 
Str$(SuccessRecord("A6D2")) 
Str$(SuccessRecord("A6D3")) 

Str$(SuccessRecord("A6D4")) 
Str$(SuccessRecord("  A6D5  ")) 
Str$(SuccessRecord("A6D6")) 
Str$(SuccessRecord("A6D7")) 
Str$(SuccessRecord("  A6D8 ")) 
Str$(SuccessRecord(M  A7D 1  ")) 
Str$(SuccessRecord("A7D2H)) 
Str$(SuccessRecord("A7D3M)) 
Str$(SuccessRecord("A7D4")) 
Str$(SuccessRecord("  A7D5 ")) 
Str$(SuccessRecord("A7D6M)) 
Str$(SuccessRecord("A7D7")) 
Str$(SuccessRecord("A7D8H)) 
Str$(SuccessRecord("A8D  1 ")) 
Str$(SuccessRecord("A8D2")) 
Str$(SuccessRecord("A8D3")) 
Str$(SuccessRecord("A8D4")) 
Str$(SuccessRecord(M  A8D5  ")) 
Str$(SuccessRecord("A8D6")) 
Str$(SuccessRecord("A8D7")) 
Str$(SuccessRecord("A8D8")) 


If  Multi  =  True  Then 

MovelSum  =  SuccessRecord(MAlDl")  +  SuccessRecord("A2Dl")  +  SuccessRecord("A3Dl")  + 
SuccessRecord("A4Dl")  +  SuccessRecord("A5Dl")  +  SuccessRecord(,'A6DT')  +  SuccessRecord("A7Dl") 
+  SuccessRecord("A8Dl") 

Move2Sum  =  SuccessRecord("AlD2")  +  SuccessRecord("A2D2")  +  SuccessRecord("A3D2")  + 
SuccessRecord(MA4D2")  +  SuccessRecord("A5D2")  +  SuccessRecord("A6D2")  +  SuccessRecord(MA7D2") 
+  SuccessRecord("A8D2") 

Move3Sum=  SuccessRecord("AlD3")  +  SuccessRecord("A2D3")  +  SuccessRecord(HA3D3”)  + 
SuccessRecord("A4D3")  +  SuccessRecord("A5D3")  +  SuccessRecord("A6D3")  +  SuccessRecord("A7D3") 
+  SuccessRecord("A8D3") 
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Move4Sum  -  SuccessRecord("AlD4")  +  SuccessRecord("A2D4")  +  SuccessRecord("A3D4")  + 
SuccessRecord("A4D4")  +  SuccessRecord("A5D4")  +  SuccessRecord("A6D4")  +  SuccessRecord("A7D4") 
+  SuccessRecord("A8D4") 

MoveSSum  =  SuccessRecord("AlD5")  +  SuccessRecord("A2D5")  +  SuccessRecord("A3D5")  + 
SuccessRecord(MA4D5")  +  SuccessRecord(MA5D5")  +  SuccessRecord("A6D5")  +  SuccessRecord("A7D5") 
+  SuccessRecord("A8D5") 

Move6Sum  =  SuccessRecord("AlD6")  +  SuccessRecord("A2D6")  +  SuccessRecord(MA3D6")  + 
SuccessRecord("A4D6")  +  SuccessRecord("A5D6")  +  SuccessRecord("A6D6")  +  SuccessRecord("A7D6") 
+  SuccessRecord("A8D6") 

Move7Sum  =  SuccessRecord("AlD7")  +  SuccessRecord("A2D7")  +  SuccessRecord(nA3D7M)  + 
SuccessRecord("A4D7")  +  SuccessRecord(MA5D7")  +  SuccessRecord("A6D7")  +  SuccessRecord("A7D7") 
+  SuccessRecord("A8D7") 

Move8Sum  =  SuccessRecord("AlD8")  +  SuccessRecord("A2D8")  +  SuccessRecord("A3D8")  + 
SuccessRecord("A4D8")  +  SuccessRecord("A5D8")  +  SuccessRecord("A6D8")  +  SuccessRecord("A7D8") 
+  SuccessRecord("A8D8") 

Else 

MovelSum  =  SuccessRecord(”AlDl")  +  SuccessRecord("A4Dl")  +  SuccessRecord("A6Dl")  + 
SuccessRecord("  A8D 1 ") 

Move4Sum  =  SuccessRecord("AlD4")  +  SuccessRecord("A4D4")  +  SuccessRecord("A6D4")  + 
SuccessRecord("A8D4") 

Move6Sum  =  SuccessRecord("AlD6")  +  SuccessRecord("A4D6")  +  SuccessRecord("A6D6")  + 
SuccessRecord("A8D6") 

Move8Sum  =  SuccessRecord("AlD8")  +  SuccessRecord("A4D8")  +  SuccessRecord("A6D8")  + 
SuccessRecord("A8D8") 

End  If 


CurrentDb.QueryDefs. Delete  "FindSuccess"  &  Subject 
CurrentDb.QueryDefs.Reffesh 

Query  =  "SELECT  *  FROM  Games  WHERE  GamelD  =M  &  Game 

Set  FindGames  =  CurrentDb.CreateQueryDef("FindGames"  &  Subject,  Query) 

Set  GamesRecord  =  FindGames.OpenRecordset 

Percentl  =  Str$(GamesRecord("APercentl")) 

Percent2  =  Str$(GamesRecord("APercent2")) 

Strategyl  =  GamesRecord  lAStrategyl 

Strategy2  =  GamesRecord!  AStrategy2 

Strategy3  =  GamesRecord  !AStrategy3 

If  Budget  =  True  Then 

IncomeBox  =  GamesRecord!  Income 

Strategyl  CostBox  =  GamesRecord!  Strategyl  Cost 

Strategy2CostBox  =  GamesRecord  !Strategy2Cost 

Strategy3  CostBox  =  GamesRecord!  Strategy3  Cost 

BudgetBox  =  IncomeBox 

BudgetBox.Visible  =  True 

Label252.Visible  =  True 

Labell22.Visible  =  True 

Label247.  Visible  =  True 

MoveCost.  Visible  =  True 
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End  If 


CurrentDb.QueryDefs.Delete  "FindGames"  &  Subject 
CurrentDb.QueryDefs.Refresh 

If  Multi  =  True  Then 
If  Move  1  Sum  >=  5  Then 
Move  1  Success  =  "Better  than  75%" 

Elself  Move  1  Sum  >=  4  Then 
Move  1  Success  =  "Better  than  50%" 

Elself  Move  1  Sum  >=  2  Then 

Move  1  Success  =  "Better  than  25%" 

Else 

Move  1  Success  =  "Less  than  25%" 

End  If 

If  Move2Sum  >=  5  Then 

Move2Success  -  "Better  than  75%" 

Elself  Move2Sum  >=  4  Then 
Move2Success  =  "Better  than  50%" 

Elself  Move2  Sum  >=  2  Then 

Move2Success  =  "Better  than  25%" 

Else 

Move2Success  =  "Less  than  25%" 

End  If 

If  Move3Sum  >=  5  Then 

Move3Success  =  "Better  than  75%" 

Elself  Move3  Sum  >=  4  Then 

Move3Success  -  "Better  than  50%" 

Elself  Mo ve3  Sum  >=  2  Then 
Move3Success  =  "Better  than  25%" 

Else 

Move3Success  =  "Less  than  25%" 

End  If 

If  Move4Sum  >=  5  Then 
Move4Success  =  "Better  than  75%" 

Elself  Move4Sum  >=  4  Then 

Move4Success  =  "Better  than  50%" 

Elself  Move4Sum  >=  2  Then 

Move4Success  =  "Better  than  25%" 

Else 

Move4Success  =  "Less  than  25%" 

End  If 

If  MoveS  Sum  >=  5  Then 
Move5Success  =  "Better  than  75%" 

Elself  Mo ve5  Sum  >=  4  Then 
Move5 Success  =  "Better  than  50%" 

Elself  Mo ve5  Sum  >=  2  Then 
Move5Success  =  "Better  than  25%" 

Else 

Move5Success  =  "Less  than  25%" 

End  If 

If  Move6Sum  >=  5  Then 
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Move6Success  =  "Better  than  75%" 
Elself  Move6Sum  >=  4  Then 

Move6Success  =  "Better  than  50%" 
Elself  Move6Sum  >=  2  Then 
Move6Success  =  "Better  than  25%" 
Else 

Move6Success  =  "Less  than  25%" 
End  If 

If  Move7Sum  >=  5  Then 
Move7Success  =  "Better  than  75%" 
Elself  Mo ve7Sum  >=  4  Then 
Move7Success  =  "Better  than  50%" 
Elself  Move7 Sum  >=  2  Then 
Move7Success  =  "Better  than  25%" 
Else 

Move7Success  =  "Less  than  25%" 
End  If 

If  Move8Sum  >=  5  Then 

Move8Success  =  "Better  than  75%" 
Elself  Mo  ve8Sum  >=  4  Then 
Move8Success  =  "Better  than  50%" 
Elself  Move8Sum  >=  2  Then 
Move8Success  =  "Better  than  25%" 
Else 

Move8Success  =  "Less  than  25%" 
End  If 


Else 

If  Move  1  Sum  >=2.75  Then 
MovelSuccess  =  "Better  than  75%" 
Elself  Move  1  Sum  >=2.5  Then 
MovelSuccess  =  "Better  than  50%" 
Elself  Move  1  Sum  >=  2  Then 

MovelSuccess  =  "Better  than  25%" 
Else 

MovelSuccess  =  "Less  than  25%" 
End  If 

If  Move4Sum  >=  2.75  Then 
Move4Success  =  "Better  than  75%" 
Elself  Move4Sum  >=  2.5  Then 
Move4Success  =  "Better  than  50%" 
Elself  Move4Sum  >=  2  Then 
Move4Success  =  "Better  than  25%" 
Else 

Move4Success  =  "Less  than  25%" 
End  If 

If  Move6Sum  >=  2.75  Then 
Move6Success  =  "Better  than  75%" 
Elself  Move6Sum>=  2.5  Then 
Move6Success  =  "Better  than  50%" 
Elself  Move6Sum  >=  2  Then 
Move6Success  =  "Better  than  25%" 


Else 

Move6Success  =  ’’Less  than  25%" 
End  If 

If  Move8Sum  >=  2.75  Then 
Move8Success  =  "Better  than  75%" 
Elself  Move8Sum  >=  2.5  Then 
Move8Success  =  "Better  than  50%" 
Elself  Move8Sum  >=  2  Then 
Move8Success  =  "Better  than  25%" 
Else 

Move8Success  =  "Less  than  25%" 
End  If 

End  If 


’Set  up  match  payoff  table  for  defender  -  attacker  will  simply  link  to  it 
If  Defender  -  True  Then 

'Check  if  Match  Table  already  exists 
TableExists  =  False 

For  Each  MatchTable  In  CurrentDb.TableDefs 
If  MatchTable.Name  =  "Match"  &  Match  Then 
TableExists  =  True 
End  If 
Next 

If  TableExists  =  False  Then 

Set  MatchTable  =  CurrentDb.CreateTableDef( "Match"  &  Match) 

Set  MatchField  =  MatchTable.CreateField("Tum") 

MatchField.Type  =  DBINTEGER 

MatchTable.Fields. Append  MatchField 

Set  MatchField  =  MatchTable.CreateField("SuccessNumber") 

MatchField.Type  =  DBSINGLE 

MatchTable.Fields. Append  MatchField 

Set  MatchField  =  MatchTable.CreateField("DefenderMoved") 

MatchField.Type  -  DB JBOOLEAN 

MatchField.DefaultValue  =  False 

MatchTable.Fields. Append  MatchField 

Set  MatchField  -  MatchTable.CreateField("DefenseSuccess") 

MatchField.Type  =  DBBOOLEAN 

MatchField.DefaultValue  =  False 

MatchTable.Fields. Append  MatchField 

Set  MatchField  =  MatchTable.CreateField("AMove") 

MatchField.Type  -  DB  TEXT 

MatchField.AllowZeroLength  =  True 

MatchTable.Fields. Append  MatchField 

Set  MatchField  =  MatchTable.CreateField("DMove") 

MatchField.Type  =  DBTEXT 

MatchField.AllowZeroLength  =  True 

MatchTable.Fields. Append  MatchField 

CurrentDb.TableDefs.Append  MatchTable 

CurrentDb.TableDefs.Refresh 

Set  TumRecord  =  CurrentDb.OpenRecordset( "Match"  &  Match) 
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Set  HistoryRecord  =  CurrentDb.OpenRecordset("History") 

For  i  =  1  To  50 

'Now  create  turn  Entries 
TumRecord.AddNew 
TumRecord("Tum")  =  i 
TumRecord("AMove")  - "" 

TurnRecord("DMove")  = "" 

TumRecord.Update 
'Setup  History  Table  Records 
HistoryRecord.AddNew 
HistoryRecord(”MatchID")  =  Match 
HistoryRecord("Tum")  =  i 
HistoryRecord.Update 
Next 
End  If 

End  If 

GoTo  Out '  skip  error  handling 

'Labels  Section 

Common_Error: 

If  BlownUp  >50  Then 
Resume  Fatal 

Elself  Err. Number  =  3012  Then 

If  StrComp(Query,  "SELECT  *  FROM  Matches  WHERE  Defender  ="  &  Subject)  =  0  Then 
CurrentDb.QueryDefs.Delete  "FindMatch"  &  Subject 
CurrentDb.QueryDefs.Refresh 

Elself  StrComp(Query,  "SELECT  *  FROM  Matches  WHERE  Attacker  ="  &  Subject)  =  0  Then 
CurrentDb.QueryDefs.Delete  "FindMatch"  &  Subject 
CurrentDb.QueryDefs.Refresh 

Elself  StrComp(Query,  "SELECT  *  FROM  Payoffs  WHERE  GamelD  ="  &  Game)  =  0  Then 
CurrentDb.QueryDefs.Delete  "FindPayoff" '  &  Subject 
CurrentDb.QueryDefs.Refresh 

Elself  StrComp(Query,  "SELECT  *  FROM  Success  WHERE  GamelD  ="  &  Game)  =  0  Then 
CurrentDb.QueryDefs.Delete  "FindSuccess"  &  Subject 
CurrentDb.QueryDefs.Refresh 
End  If 

Resume  Begin 
Else 

BlownUp  =  BlownUp  +  1 

Set  ErrorRecord  =  CurrentDb.OpenRecordset("Errors",  DBOPENDYNASET) 

With  ErrorRecord 
.AddNew 

IBlownUpCount  =  BlownUp 
!ErrorDesc  =  Err.Description 
!ErrorNumber  =  Err  .Number 
.Update 
End  With 
Resume  Begin 
End  If 

Fatal: 

MsgBox  "An  Error  has  Occurred  in  Form  GameForm: Class  Module  Load_Form.  Notify  Experimenter" 
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GoTo  Out 


Out: 

End  Sub 

Private  Sub  GameHelpButton_Click() 


DoCmd.OpenForm  "DefenderHelp" 


End  Sub 

Public  Sub  MakeMove_Click() 

Dim  MatchReady  As  Boolean 

Dim  Defender  As  Boolean,  Rational  As  Boolean,  Multi  As  Boolean,  Budget  As  Boolean 
Dim  AttackerMove  As  String,  DefenderMove  As  String,  MoveString  As  String 
Dim  InitPayoff  As  Integer,  i  As  Integer,  MsgResponse  As  Integer,  BlownUp  As  Integer,  WaitCount  As 
Integer 

Dim  Turn  As  Integer,  Match  As  Integer,  Game  As  Integer 

Dim  AttackerPayoff  As  Single,  DefenderPayoff  As  Single,  SuccessProb  As  Single 

Dim  RandomNumber  As  Single 

Dim  TumRecord  As  Recordset,  ErrorRecord  As  Recordset 
Dim  MatchTable  As  TableDef 
Dim  AttackValue  As  Single 


On  Error  GoTo  ErrorHandler 


Begin: 

BlownUp  =  0 

Defender  =  Forms  !GameForm!DefenderBox 
Rational  -  Forms  !GameForm!RationalBox 
Multi  -  Forms  !GameForm!MultipleBox 
Budget  =  Forms!GameForm!BudgetaryBox 
Turn  =  Forms!GameForm!TumBox 
Match  =  Forms!GameForm!MatchBox 
Game  =  Forms  !GameForm!GameB  ox 

If  Multi  =  True  Then 
DMoveBox  =  MultiMoveBox 
Else 

DMoveBox  =  SingleMoveBox 
End  If 

If  IsNull(DMoveBox)  Then 
GoTo  NoMove 
Elself  Budget  =  True  Then 

test  =  CalcBudget(DMoveBox,  Multi) 
If  test  =  False  Then 
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GoTo  Out 
End  If 
End  If 

If  Rational  =  True  Then 
Randomize 
AttackValue  =  Rnd 
AttackValuebox  =  AttackValue 

If  AttackValue  <=  Forms  !GameForm!  Percent  1  Then 
AttackerMove  =  Forms!  GameForm!  Strategy  1 

Elself  AttackValue  <=  Forms! GameForm! Percent2  Then 
AttackerMove  =  Forms!  GameForm!  Strategy2 

Else 

AttackerMove  =  Forms!GameForm!Strategy3 
End  If 
Else 

Randomize 

AttackValue  =  Int((8  *  Rnd)  +1) 

If  AttackValue  =  "1"  Then 
AttackerMove  =  "Al" 

Elself  AttackValue  =  "2"  Then 
AttackerMove  =  "A2" 

Elself  AttackValue  =  "3"  Then 
AttackerMove  =  "A3n 
Elself  AttackValue  =  ”4"  Then 
AttackerMove  =  "A4" 

Elself  AttackValue  =  ”5"  Then 
AttackerMove  =  "A5" 

Elself  AttackValue  =  "6"  Then 
AttackerMove  =  "A6" 

Elself  AttackValue  =  "7”  Then 
AttackerMove  =  "A7” 

Else 

AttackerMove  =  "A8" 

End  If 
End  If 

attackbox  =  AttackerMove 

DefenderMove  =  ConvertMove(DMoveBox,  True) 
defendbox  -  DefenderMove 

Set  TumRecord  =  CurrentDb.OpenRecordset("Match,,  &  Match,  DB_OPEN_DYNASET) 
TumRecord.FindFirst  "[Turn]  =  "  &  Turn 
WaitCount  -  0 

While  TumRecord.EditMode  =  dbEditlnProgress 
If  WaitCount  >  40000  Then 

MsgResponse  =  MsgBox("Move  processing  may  be  taking  too  long.  Notify  the  Experimenter. 
Continue  Waiting?",  vbYesNo) 

If  MsgResponse  =  vbYes  Then 
WaitCount  -  0 
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Else 

GoTo  Out 
End  If 
End  If 

WaitCount  =  WaitCount  +  1 
Wend 

TumRecord.Edit 

TumRecord("DMove")  =  DefenderMove 
TumRecord("AMove")  —  AttackerMove 
TumRecord.Update 
DoCmd.Hourglass  True 
WaitCount  =  0 


DoCmd.Hourglass  False 
’Get  Initial  Payoff 

MoveString  =  AttackerMove  &  DefenderMove 
InitPayoff  =  FindPayoff(MoveString) 

SuccessProb  =  FindSuccess(MoveString) 

WaitCount  =  0 

While  TumRecord.EditMode  =  dbEditlnProgress 
If  WaitCount  >  40000  Then 

MsgResponse  =  MsgBox(’’Move  processing  may  be  taking  too  long.  Notify  the  Experimenter. 
Continue  Waiting?”,  vbYesNo) 

If  MsgResponse  =  vbYes  Then 
WaitCount  =  0 
Else 

GoTo  Out 
End  If 
End  If 

WaitCount  =  WaitCount  +  1 
Wend 

TumRecord.Edit 

Randomize 

TumRecord(”SuccessNumber")  =  Rnd() 

If  TumRecord("SuccessNumber”)  <  SuccessProb  Then 
DefenderPayoff  =  0 
TumRecord(”DefenseSuccess”)  =  Tme 
MoveSuccessBox  =  ’'Successful!” 

Else 

DefenderPayoff  =  InitPayoff 
TumRecord(”DefenseSuccess”)  =  False 
MoveSuccessBox  =  ’’Unsuccessful!” 

End  If 

TumRecord("DefenderMoved")  =  Tme 

TumRecord.Update 

TumRecord.Close 

LastPayoffBox  =  PayoffBox 

PayoffBox  =  DefenderPayoff 

TotalPayoffBox  =  TotalPayoffBox  +  DefenderPayoff 

Call  UpdateHistory(AttackerMove,  DefenderPayoff,  DefenderMove,  Match,  Turn) 

Beep 
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'Check  if  50  turns  completed 
If  Turn  =  50  Then 

MsgBox  "You  Have  Completed  The  Experiment.  Please  Close  the  Program.  Thanks  for  Your 
Participation" 

Application. Quit  acPrompt 
GoTo  Out 
End  If 

'Normal  End  of  Turn  Processing 
Turn  =  Turn  +  1 

Forms!GameForm!TurnBox  =  Turn 
GoTo  Out 

'LABELS  SECTION 
NoJVIove: 

MsgBox  "Please  Select  a  Move!" 

If  Multi  =  True  Then 
MultiMo  veB  ox .  S  etFocus 
Else 

SingleMoveBox.SetFocus 
End  If 
GoTo  Out 

ErrorHandler: 


Resume  Begin 
'BlownUp  =  BlownUp  +  1 

'Set  ErrorRecord  =  CurrentDb.OpenRecordset("Errors",  DB  OPEN  DYNASET) 
'  With  ErrorRecord 
'  .AddNew 

*  IBlownUpCount  =  BlownUp 
'  !ErrorDesc  =  Err. Description 
'  !ErrorNumber  =  Err  .Number 
'  .Update 
'End  With 
'  Resume 


Abort: 

MsgBox  "Experiment  Terminated!" 

DoCmd. Hourglass  False 
DoCmd. Close  acForm,  "GameForm" 

Out: 

End  Sub 

Public  Function  FindPayoff(Move  As  String)  As  Integer 
If  Move  ~  "A1D1"  Then 

FindPayoff  -  Int(Forms!  GameForm!  A 1 D 1  Payoff) 
Elself  Move  —  "A1D2"  Then 
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FindPayoff  =  Int(Forms!GameForm!AlD2Payoff) 
Elself  Move  —  "A1D3"  Then 

FindPayoff  =  Int(Forms!GameForm!AlD3Payoff) 
Elself  Move  =  "A1D4"  Then 

FindPayoff  =  Int(Forms!GameForm!AlD4Payoff) 
Elself  Move  =  "  AIDS"  Then 

FindPayoff  =  Int(Forms!GameForm!AlD5Payoff) 
Elself  Move  =  "A1D6"  Then 
FindPayoff  =  Int(Forms !  GameFomi!  A 1  D6Payoff) 
Elself  Move  =  "A1D7"  Then 

FindPayoff  =  Int(Forms!GameForm!AlD7Payoff) 
ElseIfMove  =  "AlD8"Then 
FindPayoff  =  Int(Forms!GameForm!AlD8Payoff) 
Elself  Move  =  "A2D1"  Then 
FindPayoff  =  Int(Forms!GameForm!A2DlPayoff) 
Elself  Move  =  "A2D2"  Then 
FindPayoff  =  Int(Forms!GameForm!A2D2Payoff) 
Elself  Move  =  "A2D3"  Then 

FindPayoff  -  Int(Forms!  GameFomi!  A2D 3 Payoff) 
Elself  Move  =  "A2D4”  Then 

F  indPayoff  =  Int(F  orms !  GameF  orm!  A2D4Payoff) 
Elself  Move  =  "A2D5”  Then 

FindPayoff  -  Int(Forms!  GameF orm!  A2D5  Payoff) 
Elself  Move  =  ,,A2D6,,  Then 

FindPayoff  =  Int(Forms!GameForm!A2D6Payoff) 
Elself  Move  =  "A2D7"  Then 

FindPayoff  =  Int(Forms!GameForm!A2D7Payoff) 
Elself  Move  =  "A2D8"  Then 
F  indPayoff  =  Int(F  orms !  GameForm !  A2D  8Payoff) 
Elself  Move  =  "A3D1"  Then 
FindPayoff  =  Int(Forms!  GameForm!  A3DlPayoff) 
Elself  Move  =  "A3D2H  Then 
FindPayoff  =  Int(Forms!  GameForm!  A3D2Payoff) 
Elself  Move  =  "  A3D3  "  Then 
FindPayoff  =  Int(Forms !  GameForm!  A3D3  Payoff) 
Elself  Move  =  "A3D4"  Then 
FindPayoff  =  Int(Forms!GameForm!A3D4Payoff) 
Elself  Move  =  "A3D5"  Then 

FindPayoff  -  Int(Forms!GameForm!A3D5Payoff) 
Elself  Move  =  "A3D6"  Then 

FindPayoff  =  Int(Forms!  GameForm!  A3  D6Payoff) 
Elself  Move  =  MA3D7"  Then 
FindPayoff  =  Int(Forms!GameForm!A3D7Payoff) 
Elself  Move  =  MA3D8M  Then 
FindPayoff  =  Int(Forms!GameForm!A3D8Payoff) 
Elself  Move  =  MA4Dln  Then 
FindPayoff  =  Int(Forms!GameForm!A4DlPayoff) 
Elself  Move  =  MA4D2"  Then 
FindPayoff  =  Int(Forms!  GameForm!  A4D2Payoff) 
Elself  Move  =  "  A4D3 Then 
FindPayoff  =  Int(Forms!GameForm!  A4D3Payoff) 
Elself  Move  =  "A4D4"  Then 
FindPayoff  =  Int(Forms!  GameForm!  A4D4Payoff) 
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Elself  Move  =  "A4D5"  Then 

FindPayoff  =  Int(Forms!GameForm!A4D5Payoff) 
Elself  Move  =  "A4D6"  Then 
FindPayoff  =  Int(Forms!GameForm!A4D6Payoff) 
Elself  Move  =  "A4D7"  Then 
FindPayoff  =  lnt(Forms!GameForm!A4D7Payoff) 
Elself  Move  =  "A4D8"  Then 

FindPayoff  =  Int(Forms!GameForm!A4D8Payoff) 
Elself  Move  =  "A5D1"  Then 
FindPayoff  =  Int(Forms!GameForm!A5DlPayoff) 
Elself  Move  =  "A5D2"  Then 
FindPayoff  =  Int(Forms!GameForm!A5D2Payoff) 
Elself  Move  =  "A5D3"  Then 

FindPayoff  =  Int(Forms!GameForm!A5D3Payoff) 
Elself  Move  =  "A5D4"  Then 
FindPayoff  =  Int(Forms !  GameForm!  A5D4Payoff) 
Elself  Move  =  "A5D5"  Then 
FindPayoff  =  Int(Forms!GameForm!A5D5Payoff) 
Elself  Move  =  "A5D6"  Then 

FindPayoff  =  Int(Forms!GameForm!A5D6Payof]f) 
Elself  Move  =  "A5D7”  Then 
FindPayoff  =  Int(Forms !  GameForm!  A5D7Payoff) 
Elself  Move  =  "A5D8"  Then 
F  indPayoff  =  Int(F  orms !  GameForm!  A5D8Payoff) 
Elself  Move  =  "A6D 1  ”  Then 

FindPayoff  =  Int(Forms!GameForm!A6DlPayoff) 
Elself  Move  =  "A6D2"  Then 

FindPayoff  =  Int(Forms!GameForm!A6D2Payoff) 
Elself  Move  =  "A6D3"  Then 

F  indPayoff  =  Int(F  orms !  GameForm!  A6D3Payoff) 
Elself  Move  =  "A6D4”  Then 
FindPayoff  =  Int(Forms!GameForm!A6D4Payoff) 
Elself  Move  =  "A6D5"  Then 

F  indPayoff  =  Int(F  orms !  GameF  orm !  A6D5  Pay  off) 
Elself  Move  =  "A6D6"  Then 
F  indPayoff  =  Int(F  orms !  GameForm!  A6D6Payoff) 
Elself  Move  =  "A6D7"  Then 

FindPayoff  =  Int(Forms !  GameForm!  A6D7Payoff) 
Elself  Move  =  ”  A6D8"  Then 

FindPayoff  =  Int(Forms!GameForm!A6D8Payoff) 
Elself  Move  =  "A7D1"  Then 
FindPayoff  =  Int(Forms  [GameForm!  A7D1  Payoff) 
Elself  Move  =  "A7D2"  Then 

FindPayoff  =  Int(Forms!GameForm!A7D2Payoff) 
Elself  Move  =  "A7D3”  Then 
FindPayoff  =  fnt(Forms!GameForm!A7D3Payoff) 
Elself  Move  =  "A7D4"  Then 
FindPayoff  =  Int(Forms!GameForm!A7D4Payoff) 
Elself  Move  =  "A7D5"  Then 

FindPayoff  =  Int(Forms !  GameForm!  A7D5Payoff) 
Elself  Move  =  "A7D6"  Then 
FindPayoff  =  Int(F  orms !  GameForm!  A7D6Payoff) 
Elself  Move  =  "A7D7"  Then 
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FindPayoff  =  Int(Forms!GameForm!A7D7Payoff) 
Elself  Move  -  " A7D8"  Then 

FindPayoff  =  Int(Forms!GameForm!A7D8Payoff) 
Elself  Move  =  "  A8D 1 "  Then 

F  indP  ayoff  =  Int(F  orms !  GameF  orm !  A8D 1  Payoff) 
Elself  Move  =  "A8D2"  Then 
FindPayoff  =  Int(Forms!GameForm!A8D2Payoff) 
Elself  Move  -  " A8D3 "  Then 

FindPayoff  =  Int(Forms!GameForm!A8D3Payoff) 
Elself  Move  =  "A8D4"  Then 
FindPayoff  =  Int(Forms!  GameF orm!  A8D4Payoff) 
Elself  Move  =  "  A8D5 1 ”  Then 
FindPayoff  =  Int(Forms!GameForm!A8D5Payoff) 
Elself  Move  =  "A8D6"  Then 

F  indPay  off  =  Int(F  orms !  GameF  orm!  A  8D  6Payoff) 
Elself  Move  =  "A8D7"  Then 
FindPayoff  =  Int(Forms!GameForm!A8D7Payoff) 
Elself  Move  =  "A8D8”  Then 
FindPayoff^  Int(Forms!GameForm!A8D8Payoff) 
End  If 

End  Function 

Public  Function  FindSuccess(Move  As  String)  As  Single 

If  Move  =  "A1D1"  Then 
FindSuccess  =  Forms!GameForm!AlDlSuccess 
Elself  Move  =  "A1D2"  Then 
FindSuccess  =  Forms  !GameForm!  A 1D2  Success 
ElseIfMove  =  "AlD3M  Then 

FindSuccess  =  Forms!GameForm!AlD3Success 
Elself  Move  =  "A1D4"  Then 

FindSuccess  =  Forms!GameForm!AlD4Success 
EIseIfMove  =  "AlD5"  Then 
FindSuccess  -  Forms  !GameForm!AlD5 Success 
Elself  Move  =  "A1D6M  Then 

FindSuccess  =  Forms!  GameF  orm!  A  lD6Success 
Elself  Move  =  ,,A1D7M  Then 

FindSuccess  =  Forms!GameForm!AlD7Success 
Elself  Move  =  "A1D8M  Then 

FindSuccess  =  Forms!  GameF  orm!  A 1D8  Success 
Elself  Move  =  HA2DP  Then 
FindSuccess  =  Forms!GameForm!A2Dl  Success 
Elself  Move  =  ,,A2D2n  Then 
FindSuccess  =  Forms  !GameForm!A2D2Success 
Elself  Move  =  ,,A2D3n  Then 
FindSuccess  =  Forms!GameForm!A2D3Success 
Elself  Move  -  "A2D4"  Then 
FindSuccess  =  Forms!GameForm!A2D4Success 
Elself  Move  =  MA2D5H  Then 
FindSuccess  =  Forms!  GameForm!A2D5Success 
Elself  Move  -  "A2D6"  Then 

FindSuccess  =  Forms!  GameF  orm!  A2D6Success 
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Elself  Move  =  ”A2D7M  Then 

FindSuccess  =  Forms  !GameForm!A2D7Success 
Elself  Move  =  ?,A2D8"  Then 

FindSuccess  =  Forms  !GameForm!A2D  8  Success 
Elself  Move  =  "A3D1"  Then 

FindSuccess  =  Forms  !GameForm!A3Dl  Success 
Elself  Move  =  "A3D2"  Then 

FindSuccess  =  Forms  !GameForm!A3D2Success 
ElseIfMove  =  "A3D3”  Then 

FindSuccess  =  Forms  IGameForm!  A3D3Success 
Elself  Move  =  "A3D4"  Then 

FindSuccess  =  Forms!  GameForm!A3D4Success 
Elself  Move  =  "A3D5"  Then 
FindSuccess  =  Forms  !GameForm!A3D  5  Success 
Elself  Move  =  "A3D6"  Then 
FindSuccess  =  Forms  IGameForm!  A3D6Success 
Elself  Move  =  "A3D7"  Then 
FindSuccess  =  Forms  IGameForm!  A3 D7Success 
Elself  Move  =  "A3D8"  Then 
FindSuccess  =  Forms  IGameForm!  A3D 8 Success 
Elself  Move  =  "A4D1M  Then 

FindSuccess  =  Forms  !GameForm!A4Dl  Success 
Elself  Move  =  "A4D2"  Then 
FindSuccess  =  Forms  IGameForm!  A4D2Success 
Elself  Move  =  "A4D3"  Then 
FindSuccess  =  Forms  !GameForm!A4D3  Success 
Elself  Move  =  "A4D4"  Then 
FindSuccess  =  Forms  IGameForm!  A4D4Success 
Elself  Move  =  "A4D5"  Then 

FindSuccess  =  Forms!GameForm!A4D5Success 
Elself  Move  =  HA4D6n  Then 

FindSuccess  =  Forms  IGameForm!  A4D6Success 
Elself  Move  =  MA4D7"  Then 
FindSuccess  =  Forms  !GameForm!A4D7Success 
Elself  Move  =  nA4D8M  Then 
FindSuccess  =  Forms!GameForm!A4D8Success 
Elself  Move  =  nA5Dl"  Then 
FindSuccess  =  Forms  IGameForm!  A5D1  Success 
Elself  Move  =  "A5D2"  Then 
FindSuccess  =  Forms  IGameForm!  A5D2 Success 
Elself  Move  =  MA5D3n  Then 

FindSuccess  =  Forms!GameForm!A5D3Success 
Elself  Move  =  "A5D4"  Then 

FindSuccess  =  Forms!GameForm!A5D4Success 
Elself  Move  =  WA5D5"  Then 
FindSuccess  =  Forms  IGameForm!  A5D5  Success 
Elself  Move  -  "A5D6"  Then 

FindSuccess  =  Forms  !GameForm!A5D6Success 
Elself  Move  =  MA5D7H  Then 
FindSuccess  =  Forms  IGameForm!  A5D7Success 
Elself  Move  =  "A5D8"  Then 

FindSuccess  =  Forms  IGameForm!  A5D8Success 
Elself  Move -MA6Dln  Then 
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FindSuccess  =  Forms  !GameForm!A6Dl  Success 
Elself  Move  -  "A6D2"  Then 

FindSuccess  =  Forms!GameForm!A6D2Success 
Elself  Move  =  "A6D3"  Then 

FindSuccess  =  Forms  !GameFoim!A6D3  Success 
Elself  Move  -  "A6D4"  Then 

FindSuccess  -  Forms !GameForm!A6D4Success 
Elself  Move  =  "A6D5"  Then 

FindSuccess  =  Forms  !GameForm!A6D5  Success 
Elself  Move  -  MA6D6M  Then 

FindSuccess  =  Forms  !GameForm!A6D6Success 
Elself  Move  =  "A6D7"  Then 

FindSuccess  =  Forms!GameForm!A6D7Success 
Elself  Move  =  "A6D8"  Then 

FindSuccess  =  Forms  !GameForm!A6D8Success 
Elself  Move  =  "A7D1"  Then 

FindSuccess  =  Forms  !GameForm!A7Dl  Success 
Elself  Move  =  "A7D2"  Then 

FindSuccess  -  Forms !GameForm!A7D2Success 
Elself  Move  =  "A7D3"  Then 
FindSuccess  =  Forms  !GameForm!A7D3  Success 
Elself  Move  =  "A7D4"  Then 

FindSuccess  =  Forms  !GameForm!A7D4  Success 
Elself  Move  -  nA7D5H  Then 
FindSuccess  =  Forms  !GameForm!A7D  5  Success 
Elself  Move  =  "A7D6”  Then 
FindSuccess  =  Forms  !GameForm!A7D  6  Success 
Elself  Move  =  "A7D7”  Then 
FindSuccess  =  Forms  !GameForm!A7D7  Success 
Elself  Move  =  "A7D8"  Then 

FindSuccess  =  Forms  !GameForm!A7D  8  Success 
Elself  Move  =  "A8DT’  Then 

FindSuccess  =  Forms  !GameForm!A8Dl  Success 
Elself  Move  =  MA8D2H  Then 

FindSuccess  =  Forms  !GameForm!A8D2  Success 
Elself  Move  =  MA8D3M  Then 

FindSuccess  =  Forms  !GameForm!A8D3  Success 
Elself  Move  =  "A8D4"  Then 

FindSuccess  -  Forms  !GameForm!A8D4 Success 
Elself  Move  -  "A8D5"  Then 

FindSuccess  =  Forms  !GameForm!A8D5Success 
Elself  Move  =  MA8D6H  Then 

FindSuccess  =  Forms  !GameForm!A8D6Success 
Elself  Move  =  HA8D7M  Then 

FindSuccess  =  Forms  !GameForm!A8D7Success 
Elself  Move  -  nA8D8"  Then 

FindSuccess  =  Forms  !GameForm!A8D8Success 
End  If 

End  Function 

Public  Sub  UpdateHistory(AttMove  As  String,  DPayoff  As  Single,  DefMove  As  String,  Match  As  Integer, 

Turn  As  Integer) 
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Dim  HistoryQuery  As  QueryDef 

Dim  HistoryRecord  As  Recordset,  ErrorRecord  As  Recordset 
Dim  Query  As  String 
Dim  BlownUp  As  Integer 

On  Error  GoTo  ErrorHandler 
BlownUp  =  0 

Begin: 

If  AttMove  =  "Al"  Then 
AttMoveH  =  ’’Integrity  Attack” 

Elself  AttMove  =  "A2”  Then 
AttMoveH  =  ’’Integrity, Availability  Attack” 

Elself  AttMove  =  ”A3"  Then 

AttMoveH  =  "Integrity, Confidentiality  Attack” 

Elself  AttMove  -  ”A4"  Then 

AttMoveH  =  "Availability  Attack” 

Elself  AttMove  =  "A5”  Then 

AttMoveH  =  "Availability, Confidentiality  Attack” 

Elself  AttMove  =  ”A6”  Then 
AttMoveH  =  "Confidentiality  Attack" 

Elself  AttMove  =  ”A7”  Then 

AttMoveH  =  "Integrity, Availability, Confidentiality  Attack" 

Elself  AttMove  =  "A8"  Then 
AttMoveH  -  "None” 

End  If 

If  DefMove  =  "Dl"  Then 

DefMoveH  =  "Integrity  Defense” 

Forms!GameForm!MovelTums  =  Forms!GameForm!MovelTums  +  1 
Forms  IGameForm!  Move  1  Payoffs  =  Forms  !GameForm!  Move  1  Payoffs  +  DPayoff 
Forms  IGameForm!  Move  1  Average  =  Forms  !GameForm!Movel  Payoffs  / 
Forms!GameForm!MovelTums 
Elself  DefMove  =  "D2”  Then 

DefMoveH  =  "Integrity, Availability  Defense” 

Forms!GameForm!Move2Tums  =  Forms  IGameForm!  Move2Tums  +  1 
Forms!GameForm!Move2Payoffs  =  Forms  IGameForm!  Move2Payoffs  +  DPayoff 
Forms  IGameForm!  Mo  ve2  Average  =  Forms  IGameForm!  Move2Payoffs  / 

F  orms  I  GameF  orm!  Move2Tums 
Elself  DefMove  =  ”D3"  Then 

DefMoveH  -  "Integrity, Confidentiality  Defense” 

Forms!GameForm!Move3Tums  =  Forms  IGameForm!  Move3Tums  +  1 
Forms!GameForm!Move3Payoffs  =  Forms!  GameForm!Move3Payoffs  +  DPayoff 
Forms!GameForm!Move3Average  =  Forms!  GameForm!Move3  Payoffs  / 

Forms!  GameForm!Move3Tums 
Elself  DefMove  =  ”D4"  Then 
DefMoveH  =  "Availability  Defense" 

Forms!GameForm!Move4Tums  =  Forms  !GameForm!  Mo  ve4Tums  +  1 
Forms!GameForm!Move4Payoffs  =  Forms  IGameForm!  Mo  ve4Payoffs  +  DPayoff 
Forms ! GameF orm! Mo ve4 Average  =  Forms !GameForm!Move4Payoffs  / 

Forms !  GameF  orm!  Mo  ve4Tums 
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Elself  DefMove  =  "D5"  Then 

DefMoveH  =  " Availability, Confidentiality  Defence” 
Forms!GameForm!Move5Tums  =  Forms  !GameForm!Move5Tums  +  1 
Forms!GameForm!Move5Payoffs  =  Forms  !GameForm!Move5Payoffs  +  DPayoff 
Forms!GameForm!Move5Average  =  Forms!  GameForm!  Mo  ve5  Payoffs  / 
Forms!GameForm!Move5Tums 
Elself  DefMove  =  "D6"  Then 

DefMoveH  =  "Confidentiality  Defense" 

Forms!  GameForm!  Move  6Tums  =  Forms!  GameForm!  Mo  ve6Turns  +  1 
Forms!GameForm!Move6Payoffs  -  Forms  IGameForm!  Mo ve6Payoffs  +  DPayoff 
Forms!GameForm!Move6Average  -  Forms!GameForm!Move6Payoffs  / 

Forms !  GameForm!  Mo  ve  6Tums 
Elself  DefMove  =  "D7"  Then 

DefMoveH  =  "Integrity^vailability, Confidentiality  Defense" 
Forms!GameForm!Move7Tums  =  Forms!  GameForm!Move7Tums  +  1 
Forms!GameForm!Move7Payoffs  =  Forms!  GameForm  !Move7Pay  offs  +  DPayoff 
Forms!  GameForm!  Move7  Average  =  Forms!  GameForm!Move7Payoffs  / 

Forms !  GameForm!  Move7Tums 
Elself  DefMove  =  "D8"  Then 
DefMoveH  =  "None" 

Forms!  GameForm!Move8Tums  =  Forms!  GameForm!  Move8Tums  +  1 
Forms!GameForm!Move8Payoffs  =  Forms!  GameForm!  Mo  ve8Payoffs  +  DPayoff 
Forms! GameForm! Move8 Average  =  Forms !GameForm!Move8Payoffs  / 

F  orms !  GameForm!  Move8Tums 
End  If 

Query  =  "SELECT  *  FROM  History  WHERE  MatchID  =  "  &  Match 
Set  HistoryQuery  =  CurrentDb.CreateQueryDef("FindHistory"  &  SubjectBox,  Query) 
Set  HistoryRecord  =  HistoryQuery.  OpenRecordset 
HistoryRecord.FindFirst  "[Turn]  =  "  &  Turn 

While  HistoryRecord.EditMode  =  dbEditlnProgress 
Wend 

HistoryRecord. Edit 

HistoryRecord("DefendAction")  =  DefMoveH 
HistoryRecord("DefendPayoff ')  =  DPayoff 
HistoryRecord("AttackAction")  =  AttMoveH 
HistoryRecord.Update 
HistoryRecord.Close 
DefendHistory .  Requery 

DeleteQuery: 

CurrentDb.QueryDefs.Delete  "FindHistory"  &  SubjectBox 

CurrentDb.QueryDefs.Refresh 

GoTo  Out 

Error_Handler: 

If  Err  .Number  =  3167  Then 
Resume  Delete  Query 
Elself  Err.Number  =  3012  Then 

CurrentDb.QueryDefs.Delete  "FindHistory"  &  SubjectBox 
CurrentDb.QueryDefs.Refresh 
Resume  Begin 
Else 
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BlownUp  =  BlownUp  +  1 

Set  ErrorRecord  =  CurrentDb.OpenRecordset(  "Errors",  DB  OPEN  DYNASET) 
With  ErrorRecord 
.AddNew 

IBlownUpCount  =  BlownUp 
!ErrorDesc  =  Err.  Description 
!ErrorNumber  =  Err  .Number 
.Update 
End  With 
Resume  Begin 
End  If 

Out: 

End  Sub 

Public  Function  ConvertMove(Move  As  String,  Defender  As  Boolean)  As  String 
'Converts  Move  from  User's  Name  to  Al/Dl  Notation 


If  Move  =  "Integrity  Defense"  Then 
ConvertMove  =  "Dl" 

Elself  Move  -  "Integrity, Availability  Defense"  Then 
ConvertMove  =  "D2" 

Elself  Move  =  "Integrity, Confidentiality  Defense"  Then 
ConvertMove  =  "D3" 

Elself  Move  =  "Availability  Defense"  Then 
ConvertMove  =  "D4" 

Elself  Move  =  "Availability, Confidentiality  Defense"  Then 
ConvertMove  =  "D5" 

Elself  Move  =  "Confidentiality  Defense"  Then 
ConvertMove  =  "D6" 

Elself  Move  =  "Integrity,  Availability, Confidentiality  Defense"  Then 
ConvertMove  =  "D7" 

Else 

ConvertMove  =  "D8" 

End  If 


End  Function 


Public  Function  CalcBudget(Move  As  String,  Multi  As  Boolean)  As  Currency 
’Calculates  available  budget  based  on  strategy  cost  and  new  income 
Dim  Income  As  Currency,  Cost  As  Currency 

Begin: 

Income  =  IncomeBox 
CalcBudget  =  True 


If  Move  =  "Integrity  Defense"  Then 
Cost  =  Strategy  ICostBox 
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If  Cost  <=  BudgetBox  Then 

BudgetBox  =  BudgetBox  +  Income  -  Cost 
Else 

GoTo  NoFunds 
End  If 

ElselfMove  =  "Integrity, Availability  Defense"  Then 
Cost  =  Strategy  ICostBox  +  Strategy2CostBox 
If  Cost  <=  BudgetBox  Then 

BudgetBox  =  BudgetBox  +  Income  -  Cost 
Else 

GoTo  No  Funds 
End  If 

ElselfMove  =  "Integrity, Confidentiality  Defense"  Then 
Cost  =  Strategy  ICostBox  +  Strategy3CostBox 
If  Cost  <=  BudgetBox  Then 

BudgetBox  =  BudgetBox  +  Income  -  Cost 
Else 

GoTo  No  Funds 
End  If 

ElselfMove  -  "Availability  Defense"  Then 
Cost  =  Strategy2CostBox 
If  Cost  <=  BudgetBox  Then 

BudgetBox  =  BudgetBox  +  Income  -  Cost 
Else 

GoTo  No  Funds 
End  If 

ElselfMove  =  "Availability, Confidentiality  Defense"  Then 
Cost  =  Strategy2CostBox  +  Strategy3CostBox 
If  Cost  <=  BudgetBox  Then 

BudgetBox  =  BudgetBox  +  Income  -  Cost 
Else 

GoTo  No  Funds 
End  If 

ElselfMove  =  "Confidentiality  Defense"  Then 
Cost  =  Strategy3CostBox 
If  Cost  <=  BudgetBox  Then 

BudgetBox  =  BudgetBox  +  Income  -  Cost 
Else 

GoTo  No  Funds 
End  If 

ElselfMove  =  "Integrity, Availability, Confidentiality  Defense"  Then 
Cost  =  Strategy  ICostBox  +  Strategy2CostBox  +  Strategy3CostBox 
If  Cost  <=  BudgetBox  Then 

BudgetBox  =  BudgetBox  +  Income  -  Cost 
Else 

GoTo  No_Funds 
End  If 

Else 

Cost  =  0 

If  Cost  <=  BudgetBox  Then 

BudgetBox  =  BudgetBox  +  Income  -  Cost 
Else 

GoTo  No  Funds 
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End  If 
End  If 

GoTo  Out 

NoJFunds: 

MsgBox  "Insuficiant  Funds;  Please  Select  Diferent  Move!" 

CalcBudget  =  False 
If  Multi  =  True  Then 
MultiMo  veBox .  SetF  ocus 

Else 

SingleMoveBox.SetFocus 

End  If 
GoTo  Out 
Out: 

End  Function 

Private  Sub  MultiMo veBox_Change() 

If  MultiMoveBox  =  "Integrity  Defense"  Then 
MoveCost  =  StrategylCostBox 
Elself  MultiMoveBox  =  "Availability  Defense"  Then 
MoveCost  =  Strategy2CostBox 
Elself  MultiMoveBox  =  "Confidentiality  Defense"  Then 
MoveCost  =  Strategy3CostBox 
Elself  MultiMoveBox  =  "Integrity, Availability  Defense"  Then 
MoveCost  =  StrategylCostBox  +  Strategy2CostBox 
Elself  MultiMoveBox  =  "Integrity,Confidentiality  Defense"  Then 
MoveCost  =  StrategylCostBox  +  Strategy3CostBox 
Elself  MultiMoveBox  =  "Availability, Confidentiality  Defense"  Then 
MoveCost  =  Strategy2CostBox  +  Strategy3CostBox 
Elself  MultiMoveBox  =  "Integrity,  Availability, Confidentiality  Defense"  Then 
MoveCost  =  StrategylCostBox  +  Strategy2CostBox  +  Strategy3CostBox 
Else:  MoveCost  =  0 
End  If 
End  Sub 

Private  Sub  SingleMoveBox_Change() 

If  SingleMoveBox  =  "Integrity  Defense"  Then 
MoveCost  =  StrategylCostBox 
Elself  SingleMoveBox  =  "Availability  Defense"  Then 
MoveCost  =  Strategy2CostBox 
Elself  SingleMoveBox  =  "Confidentiality  Defense"  Then 
MoveCost  -  Strategy3CostBox 
Else:  MoveCost  =  0 
End  If 

End  Sub 
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